different time tracker/monitor

[oliver]

hi,

after help of kva.kva timesyncronisation and monitoring/logging works fine on our site - thanks again this way.

but in smart view tracker i get time -1 hour from time at SPLAT although smart view monitor shows the correct time.

are´nt both applications using the same logfile?

we´re using distributed mode - smart center server is on w2k3; both are R55 HFA_17.

kind regards from innsbruck
/oliver

[kva.kva]

I think Monitor use time from SmartCenter.

[oliver]

good morning kva.kva,

i think you are right that monitor uses time from smart center server. SPLAT uses the same timezone:

The following information has been given:

Austria

Therefore TZ='Europe/Vienna' will be used.
Local time is now: Wed Apr 5 09:27:50 CEST 2006.
Universal Time is now: Wed Apr 5 07:27:50 UTC 2006.

Wed Apr 5 09:27:50 CEST 2006 is the same time as shown on smart center server - so as i´m able to judge smart view tracker should show this time, should´nt it?

/oliver

[kva.kva]

Really, Tracker and Monitor use time from SC...

I try to find smth about Monitor.

P.S. Use GMT+0 and no problem :)

[oliver]

checkpoint says:

Solution ID: #sk30360

Product: VPN-1 Pro (VPN-1/FW-1)
Version: NG, NG AI
Last Modified: 05-Mai-2005

Solution

Time values in the log file reflect Greenwich Mean Time (GMT), and are written when an event occurs on the firewall module. Time values displayed by a Check Point application (e.g., SmartView Tracker, fwm logexport command) are calculated and adjusted to local time (time zone + Daylight Savings) by the application. Therefore, the log file will show varying time values for firewall modules located in different time zones.

Example (log event):
Firewall module located in Israel
Management/Log Server located in U.S. (Pacific)

A firewall module event occurs in Israel at GMT+2 (15:00 PM) and is logged. It will be display as 6:00 AM (PDT) by the application on the Management/Log Server side.

so checkpoint says - regardsless of which timezone is set on SPLAT smart view tracker show the time set on smart center server.

on my side tracker ond monitor are running on the same machine - tracker shows the wrong time, monitor show the correct one...

strange.

/oliver

[oliver]

i´ve now applied windows procedure :-) and restarted smart center server and now time on smart view tracker and monitor is the same.

it seems when summertime/wintertime change occurs smart center server has to be restarted to calculate time offset on SPLAT correctly.

anyway kva.kva - thank your for supporting

kind regards
/oliver

[kva.kva]

It's SmartCenter's feature, cprestart resolves problems with SC very often :)

[Lackie]

The reason this happens is that Check Point reads the time zone offset when it starts and just continues to calculate the time from there. When there is a change such as daylight savings time, it doesn't register to Check Point until you stop and restart the service.

[oliver]

Lackie - thanks a lot.

kind regards
/oliver