Wrong times on the logs (not related with previous threads)

[sergioaf]

Hello,

I have 2 customers who recently reported the same issue, which I have not seen in the past. Suddenly and without any apparent reason, the SmartView Tracker started showing wrong times on the logs generated by the gateways, tests have proven that events that are currently occuring, are showing with a difference of several hours from the actual current time.
I read, a few threads bellow, that a couple of guys mentioned an issue with automatic Daylight savings settings that change the time by one hour and causing an exact 1 hour delay, but here we are talking about random ranges (in one of the cases) of several hours.

One of my customers has a SmartCenter running over Windows 2003 and 2 firewall modules running over SPLAT as HA active/stanby cluster, on this case the difference between the actual time and the time reported by the logs generated by the gateways starts increasing until it reaches 12 hours and stays there, changing time on the sysconfig menu to match whatever is configured on the Smartcenter does not seem to cause any efect, the problem remains. This customer runs NGXR60 HFA01 and has seen random changes in the BIOS clock of at least one of the machines running a gateway.

As mentioned, a second customer has the same issue but he has everything running over SPLAT, a Smartcenter managing two Check Point Express HA active/standby clusters, only one of the clusters showing wrong times and on this case the difference between the real time and the one reported on the logs changes ramdomly everytime they try to fix the issue. This guy has NGAI R55 HFA16.

Has anyone seen this in the past, I would really appreciate any help.

Regards.

[dbedit]

Have seen this before, if BIOS clock settings change all the time, you will have to fix it first. Probably a hardware issue on that box, maybe CPU is getting to hot or CMOS battery is f*cked. If you synchronize time via NTP and BIOS clock changes all the time you will still have the issue.

[sergioaf]

Thanks a lot for your answer but the deal is, the BIOS time is only changing in one of the cases not on the other.
On any case, further tests have proven that if you boot up into the BIOS, change the time to the correct one, reboot and enter the BIOS again to check, the time is still correct, no matter how many time you do this, but if you let it boot into CheckPoint Software and reboot to check the time on the BIOS it has changed again, to a random one and not even close to what ever is reported on the Tracker logs.
In that particular case, there are 2 separate Dell servers showing that issue and Dell support says they have no patch for the BIOS and they checked the battery and it is fine, so they blame "whatever software runs on the systems"

Anybody else with similar experiences?

[melipla]

I would try sync'ing the time with ntp, and then sync'ing the bios clock with the system time:

ntpdate -sb pool.ntp.org
clock --systohc

HTH

[ruthrocios]

Originally Posted by sergioaf

Thanks a lot for your answer but the deal is, the BIOS time is only changing in one of the cases not on the other.
On any case, further tests have proven that if you boot up into the BIOS, change the time to the correct one, reboot and enter the BIOS again to check, the time is still correct, no matter how many time you do this, but if you let it boot into CheckPoint Software and reboot to check the time on the BIOS it has changed again, to a random one and not even close to what ever is reported on the Tracker logs.
In that particular case, there are 2 separate Dell servers showing that issue and Dell support says they have no patch for the BIOS and they checked the battery and it is fine, so they blame "whatever software runs on the systems"

Anybody else with similar experiences?

Sergio. did you resolve the problem of the time on the logs?. Now I Have a similar problem.

Ruth

[l0wkey]

I am also seeing this in our deployment, two SPLAT managers and 20 Gateways, all are off by 23 hours, changing time in syscofig, ntpupdate to ntp, and syncing with the bios clock all have not changed the time. Everything is SPLAT with a mix of R55 HFA13 and NGX HFA04

[northlandboy]

If you're seeing 23 hours difference now, it's due to the daylight savings change that just occurred. Run cpstop;cpstart on your management server, and it will come right.

[l0wkey]

Yea we tried that already, no dice! We figured we would have to do it on each Enforcement point, and that is going to be a problem. The NTP source, local clock and bios clock all show the correct time even after daylight savings time has occurred.

[northlandboy]

I'm not sure that you will have to restart the enforcement modules. I just dealt with one today, R55 SPLAT enforcement, Solaris mgmt - restarting the mgmt fixed up the time no problem (well, except for the fact that that module is not NTP-synced, and is a few minutes ahead, but that's another story).

Have you restarted one of the modules and gotten it working properly?

[tazmensch]

Hi all. I experienced the same issue with two Nokia IP380's with NGX R60 with HFA01 utilizing IPSO clustering. As soon as I completed a cpstop and cpstart on the Management server, the issue was resolved.

[l0wkey]

Yup cpstop and cpstart on the enforcement point did do the trick.

[jofo007]

Hi all.
I found this thread and find it usefull, but all of your suggestions didn't help!
I've Management running on W3002Server, one Nokia IP-500, one Siemens Aplliance with SPLAT.
Tracker shows a time difference about 2 hours, but the systemclocks of both System differs only 3 minutes.
Nokia is configured to run as NTP-Server and fetches time from Internet. SPLAT is configured to run as NTP-Client with the Nokia as ntp-server.
In my opinion time should be on both Systems the same.

cpstop; cprestart on management doesn't help.

any Ideas?

regards Jofo007

Edit: 18.12.2006
After setting timezone on all devices to GMT and restarting the SPLAT and MGT-System everything is fine!
Thanks to all.