Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

IDS Sensor clock display inconsistencies?

Hi all,

not sure if anyone has come accross this one before. When I log onto my IDS Sensors via SSH using a standard account the "show clock" command gives me a response one hour earlier than it should. The sensor is configured to use NTP and I suspected the problem is with the daylight savings summertime parameters.

However, this is where it gets a little perplexing: when I log into the sensor using the service account (Linux OS), the system time appears to be correct.

I've tried taking the ntp server out of the equation with little success. What tends to happen is that when I enter a time maunually, it sill subtracts an hour? (for example I enter 14:00 and "show clock" tells me the time is 13:00) The impression I'm getting is that the sensor is not parsing the daylight savings parameters correctly.

Another question in relation to this is whether the Zone name and DST Zone names are of any significance or are they simply naming variables? We're located in Sydney, Australia, so I've smply put down AEST for both. Thanks in advance.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: IDS Sensor clock display inconsistencies?

There is a cisco ddts bug written against this problem:

CSCed61826 - IDS summer time / dst show incorrect for southern hemisphere zone

description:

If you setup summertime (spanning the new year) and

your current time is within the summertime period AND past jan 1st, then

the summertime start/stop times are mistakenly calculated for the following

summertime (the next year).

Please see below the result

of show clock det before reboot and after reboot.

Before reset :

4215-1# sh clock det

*12:53:01 AEDST Sun Feb 01 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004

After reset, and IDS comes up :

4215-1# sh clock det

*01:55:53 UTC Sun Feb 01 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 03 2004

Summer time stops 01:00:00 AEST Mon Mar 28 2005

(SEE here that it is showing AEST instead of AEDST, and it would seem

to be because the summer time start and stop has moved to the new year

2004 and 2005 already, instead of the supposed 2003 to 2004 still)

4215-1# sh clock det

*11:56:27 AEST Sun Feb 01 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 03 2004

Summer time stops 01:00:00 AEST Mon Mar 28 2005

(For this to be corrected I have to make the system get the sorrect

summert time start and stop years 2003 and 2004, then it would get

february correct again to AEDST)

4215-1# clock set 13:18:00 November 1 2003

4215-1# sh clock det

*12:18:02 AEST Sat Nov 01 2003

No time source

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004

4215-1# clock set 13:18:00 February 3 2004

4215-1# sh clock det

*13:18:01 AEDST Tue Feb 03 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004

4215-1#

Further, if I then play around with clock such that I make it November

2004, then the summer time moves to 2004-2005 again, and if I go back

to February, then it would show as AEST again, not AEDST.

4215-1# clock set 13:18:00 November 1 2004

4215-1# sh clock det

*12:18:03 AEST Mon Nov 01 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 03 2004

Summer time stops 01:00:00 AEST Mon Mar 28 2005

4215-1# clock set 13:18:00 February 3 2004

4215-1# sh clock det

*12:18:02 AEST Tue Feb 03 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 03 2004

Summer time stops 01:00:00 AEST Mon Mar 28 2005

4215-1#

workaround:

If you setup summertime (spanning the new year) and your current time is within the summertime

period AND past jan 1st, then the summertime start/stop times are mistakenly calculated for the

following summertime (the next year).

In Australia, summer time start is Oct, and stop on March.

For February 2004, it should now be summer time "AEDST" Tue Feb 03 2004.

The show clock detail should have something close to

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004.

However, if the show clock detail shows the coming years summer time :

Summer time starts 03:00:00 AEDST Sun Oct 03 2004

Summer time stops 01:00:00 AEST Mon Mar 28 2005

Then February would not show the correct time

"AEST" Tue Feb 03 2004

We can try to correct the time infomration by temporarily going a year back and within the summer

time period, then correct the time again.

eg :

4215-1# clock set 13:18:00 November 1 2003

4215-1# sh clock det

*12:18:02 AEST Sat Nov 01 2003

No time source

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004

4215-1# clock set 13:18:00 February 3 2004

4215-1# sh clock det

*13:18:01 "AEDST" Tue Feb 03 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004

5 REPLIES
Cisco Employee

Re: IDS Sensor clock display inconsistencies?

Please execute a "show conf" and paste the output for the section showing the configuration of the timezone and summertime settings.

I can take a quick look to see if the configuration may be wrong, and also try it here in our lab.

Cisco Employee

Re: IDS Sensor clock display inconsistencies?

There is a cisco ddts bug written against this problem:

CSCed61826 - IDS summer time / dst show incorrect for southern hemisphere zone

description:

If you setup summertime (spanning the new year) and

your current time is within the summertime period AND past jan 1st, then

the summertime start/stop times are mistakenly calculated for the following

summertime (the next year).

Please see below the result

of show clock det before reboot and after reboot.

Before reset :

4215-1# sh clock det

*12:53:01 AEDST Sun Feb 01 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004

After reset, and IDS comes up :

4215-1# sh clock det

*01:55:53 UTC Sun Feb 01 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 03 2004

Summer time stops 01:00:00 AEST Mon Mar 28 2005

(SEE here that it is showing AEST instead of AEDST, and it would seem

to be because the summer time start and stop has moved to the new year

2004 and 2005 already, instead of the supposed 2003 to 2004 still)

4215-1# sh clock det

*11:56:27 AEST Sun Feb 01 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 03 2004

Summer time stops 01:00:00 AEST Mon Mar 28 2005

(For this to be corrected I have to make the system get the sorrect

summert time start and stop years 2003 and 2004, then it would get

february correct again to AEDST)

4215-1# clock set 13:18:00 November 1 2003

4215-1# sh clock det

*12:18:02 AEST Sat Nov 01 2003

No time source

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004

4215-1# clock set 13:18:00 February 3 2004

4215-1# sh clock det

*13:18:01 AEDST Tue Feb 03 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004

4215-1#

Further, if I then play around with clock such that I make it November

2004, then the summer time moves to 2004-2005 again, and if I go back

to February, then it would show as AEST again, not AEDST.

4215-1# clock set 13:18:00 November 1 2004

4215-1# sh clock det

*12:18:03 AEST Mon Nov 01 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 03 2004

Summer time stops 01:00:00 AEST Mon Mar 28 2005

4215-1# clock set 13:18:00 February 3 2004

4215-1# sh clock det

*12:18:02 AEST Tue Feb 03 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 03 2004

Summer time stops 01:00:00 AEST Mon Mar 28 2005

4215-1#

workaround:

If you setup summertime (spanning the new year) and your current time is within the summertime

period AND past jan 1st, then the summertime start/stop times are mistakenly calculated for the

following summertime (the next year).

In Australia, summer time start is Oct, and stop on March.

For February 2004, it should now be summer time "AEDST" Tue Feb 03 2004.

The show clock detail should have something close to

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004.

However, if the show clock detail shows the coming years summer time :

Summer time starts 03:00:00 AEDST Sun Oct 03 2004

Summer time stops 01:00:00 AEST Mon Mar 28 2005

Then February would not show the correct time

"AEST" Tue Feb 03 2004

We can try to correct the time infomration by temporarily going a year back and within the summer

time period, then correct the time again.

eg :

4215-1# clock set 13:18:00 November 1 2003

4215-1# sh clock det

*12:18:02 AEST Sat Nov 01 2003

No time source

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004

4215-1# clock set 13:18:00 February 3 2004

4215-1# sh clock det

*13:18:01 "AEDST" Tue Feb 03 2004

No time source

Summer time starts 03:00:00 AEDST Sun Oct 05 2003

Summer time stops 01:00:00 AEST Tue Mar 30 2004

New Member

Re: IDS Sensor clock display inconsistencies?

Thanks for the replies guys. Full marks go to James for the resolution.

The following lines did the trick:

# clock set 13:18:00 November 1 2003

# show clock detail

*12:18:00 AEST Sat Nov 01 2003

No time source

Summer time starts 03:00:00 AEST Sun Oct 26 2003

Summer time stops 02:00:00 AEST Tue Mar 30 2004

# clock set 10:05:00 March 10 2004

# show clock detail

*10:05:01 AEDST Wed Mar 10 2004

No time source

Summer time starts 03:00:00 AEST Sun Oct 26 2003

Summer time stops 02:00:00 AEST Tue Mar 30 2004

Incidentally, I notice in your example James that you are set to change daylight savings time on Sun Oct 05 2003. From my understanding the cutover for Australian daylight savings is the last Sunday of October - that is, assuming you're in Australia ;)

Cheers.

New Member

Re: IDS Sensor clock display inconsistencies?

BTW, any idea on whether or not this issue is going to be resolved or has been resolved by any of the Sensor updates? Having to do this manually to 9 sensors plus incorporating NTP anytime we perform any time changes during daylight savings can get to be a bit of a pain.

Cisco Employee

Re: IDS Sensor clock display inconsistencies?

A fix has been checked into our code base and is slated for the CIDS 5.0 release (you can contact the cisco TAC and request an earlier release).

225
Views
0
Helpful
5
Replies