IBM Security Guardium

 View Only
  • 1.  IBM Security Guardium System Time Issue

    Posted Sat July 04, 2020 05:46 AM
    Hello all,
    My Guardium system time changes automatically each day even I change it everyday to my current local time but it always changes to 6 hours ahead of current time. Anyone please help to set time permanently to my current local time.
    Thanks in advance.

    ------------------------------
    Abdul Rahman Information Security Engineer
    ------------------------------


  • 2.  RE: IBM Security Guardium System Time Issue

    Posted Sun July 05, 2020 05:08 AM
    Hi Abdul, it seems to me that your timezone is not setup correctly. Set the Time Zone, Date and Time in IBM Knowledge center hints that Guardium polls a time server (NTP) from time to time (daily?) to sync its time, which can explain why your time resets to -6 hours.

    I suggest to verify that your timezone is correct using the GuardAPI
    show system clock timezone

    If it isn't correct, try to change it using

    store system clock timezone list
    ...
    store system clock timezone <TIME ZONE NAME>
    ...
    show system clock timezone


    Let us know if this solves your problem.



    ------------------------------
    TAL DANIEL
    Guardium developer
    IBM Security
    Israel
    ------------------------------



  • 3.  RE: IBM Security Guardium System Time Issue

    Posted Sun July 05, 2020 05:40 AM
    Hello Daniel, Thanks for your reply. Daily, I run these commands to check timezone and date time, timezone and date always remain correct which I set initially but time is automatically set to +6 hours. I had to manually set time using command:  store system clock datetime <date-time>.

    ------------------------------
    Abdul Rahman Information Security Engineer
    ------------------------------



  • 4.  RE: IBM Security Guardium System Time Issue

    Posted Sun July 05, 2020 09:01 AM

    Abdul, did you check System CLI Commands docs for more commands and notes?

    The store system clock timezone command details that resetting timezone may be required (switch to a different time zone and return your local time zone:

    ...

    IBM® Guardium® also logs the local timezone in the standard audit trail, to address cases where data is used in (or aggregated with) data collected in another time zones.

    Note: The timezone setting is not updated automatically when Daylight Saving time occurs. In order to update the machine, the user will need to reset the timezone. Reset the timezone means to set a new timezone, different from what currently is, and then resetting to the correct timezone. Just resetting the timezone to the same one will not work and give the message, No change for the timezone.


    Did you try running diagnostics on your NTP server status, as detailed in the show system ntp diagnostics command details?

    Can you share what's the output of

    show system ntp all
    ...
    show system clock all
    ...
    show system ntp diagnostics
    ...

    If you disable the NTP server, does local time stays as you manually set it to be, after 24 hours?

    store system ntp state off

     



    ------------------------------
    TAL DANIEL
    Guardium developer
    IBM Security
    Israel
    ------------------------------



  • 5.  RE: IBM Security Guardium System Time Issue

    Posted Sun July 05, 2020 11:34 AM
    Edited by Abdul Rahman Sun July 05, 2020 11:39 AM
    Hi Daniel, I am not using any ntp server for time synchronization. I am setting local date and time manually using command: store system clock datetime <date-time>.
    Also I am attaching the results of commands you asked. In this screenshot you can see, Guardium date time is 4 hours ahead of my current local time.


    ------------------------------
    Abdul Rahman
    Information Security Engineer
    ------------------------------



  • 6.  RE: IBM Security Guardium System Time Issue

    Posted Tue July 07, 2020 09:53 AM
    Edited by TAL DANIEL Tue July 07, 2020 09:56 AM
    Abdul, I'm trying to reproduce your scenario. I'll update you if same happens to me.

    1. Disable ntp server
    2. Change timezone to local timezone
    3. Set date & time to be 15 minutes earlier than current local time (+restart gui, as instructed in command-line output)
    4. Check timezone and time are as wanted, even when exit and login again
    5. [24 hours later] Check timezone and time still hold and didn't change unexpectedly.


    ------------------------------
    TAL DANIEL
    Guardium developer
    IBM Security
    Israel
    ------------------------------



  • 7.  RE: IBM Security Guardium System Time Issue

    Posted Tue July 07, 2020 01:07 PM
    Thanks Daniel. Please let me know what you found after performing this activity.

    ------------------------------
    Abdul Rahman
    Information Security Engineer
    ------------------------------



  • 8.  RE: IBM Security Guardium System Time Issue

    Posted Wed July 08, 2020 10:03 AM
    I don't see the problem on my Standalone Guardium machine, v11.2; steps 4 & 5 in my test case above show time as set or expected, even 25 hours after date & time change. Please check your environment.

    ------------------------------
    TAL DANIEL
    Guardium developer
    IBM Security
    Israel
    ------------------------------



  • 9.  RE: IBM Security Guardium System Time Issue

    Posted Fri July 10, 2020 03:06 PM
    Thank you Daniel for your response. Yes, I asked my IT admin, he said there is time issue in our company servers. They are not syncing properly with NTP servers. So, let's see when they resolve this issue and my issue will be gone, I hope. Again, thanks for your help.

    ------------------------------
    Abdul Rahman
    Information Security Engineer
    ------------------------------