Solved: Time setting

altaf007 · ‎11-29-2004

I have IDS 4250 with current signature. I am using IDS-MC to configure this IDS. I want to set time and date but i don't see any option in IDS-MC to configure time. How do i set time and date for IDS using IDS-MC for eastern time zone?

Altaf

jamesand · ‎11-29-2004

I do not think the MC has a window for configuring timezone. If you log into the sensor CLI (admin) you can configure the timezone on the sensor. Here is an example for configuring eastern standard and daylightsavings time

NOTE1: you can take the defaults for most of the prompts

NOTE2: you will be prompted to reboot the sensor for the time offsets to take effect

#setup

...

Modify system clock settings: yes

...

Modify summer time settings: yes

Recurring:, Date, or Disable? [Recurring]:

Start Month[apr]:

Start Week[first]:

Start Day[sun]:

Start Time[02:00:00]:

End Month[oct]:

End Week[last]:

End Day[sun]:

End Time[02:00:00]:

DST Zone[]: EDT

Offset[60]:

Modify system timezone?[no]: yes

Timezone[UTC]: EST

UTC Offset[0]: -300

...

View solution in original post

calin · ‎11-29-2004

Hey Altaf007, I have the same problem. Log in the IDS and use the command:clock set....

Whoever design this product had a very narrow view. All the time is set for UTC and you can't change that. When I run reports I have to think UTC even if I'm in EST time. Hopefully with the new version you will be able to run reports in Security Monitor that will reflect your time zone. Thanks Calin

PS: I have the same set up as you have.

altaf007 · ‎11-29-2004

Thanks Calin,

a.arndt · ‎12-09-2004

We interrupt this post to bring you this response...

"Whoever design (sic) this product had a very narrow view."

Whoa! Hold on a minute.

I'm not too sure about you, but some of us running Cisco IDS have more than one or two sensors to manage, and they are not all in the same time zone.

When you have a couple dozen sensors to monitor that are spread across an entire continent (or perhaps more than one continent!!!), it only makes sense to use a centralized time zone. Furthermore, UTC has long been established as the standard for situations like this.

When you consider the larger Cisco IDS user community (think .gov, .mil, .com and folks like ISPs and MSSPs), you should be able to appreciate the intent of the default time settings on a Cisco IDS sensor, but I digress...

Alex Arndt

We now return you to your normally docile NetPro Forum.

jamesand · ‎11-29-2004

I do not think the MC has a window for configuring timezone. If you log into the sensor CLI (admin) you can configure the timezone on the sensor. Here is an example for configuring eastern standard and daylightsavings time

NOTE1: you can take the defaults for most of the prompts

NOTE2: you will be prompted to reboot the sensor for the time offsets to take effect

#setup

...

Modify system clock settings: yes

...

Modify summer time settings: yes

Recurring:, Date, or Disable? [Recurring]:

Start Month[apr]:

Start Week[first]:

Start Day[sun]:

Start Time[02:00:00]:

End Month[oct]:

End Week[last]:

End Day[sun]:

End Time[02:00:00]:

DST Zone[]: EDT

Offset[60]:

Modify system timezone?[no]: yes

Timezone[UTC]: EST

UTC Offset[0]: -300

...

altaf007 · ‎11-29-2004

Thank you so much James. This really help.

Altaf

patricko · ‎12-14-2004

Note: If you set all your sensors to run in UTC when they report alarms into SEC MON they alarm times will all be reflected in the TimeZone of the server running Sec Mon.

If you do this you will at least have all you're alarms reporting at the same time thus making it eaiser to monitor events across your enterprise. You can always translate the time to the local time of your sensor if you need to.

calin · ‎12-17-2004

Hey patricko, the VMS server is set for EST together with the IDS sensor. Under the Security Monitor I get all the alarms in UTC. I always have to convert to UTC when I select a period of time. Thanks Calin

Is yours reporting in a different time zone?