C-16
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixC Troubleshooting
Time Sources and the Sensor
Verifying the Sensor is Synchronized with the NTP Server
In IPS, you cannot apply an incorrect NTP configuration, such as an invalid NTP key value or ID, to the
sensor. If you try to apply an incorrect configuration, you receive an error message . To verify the NTP
configuration, use the show statistics host command to gather sensor statistics. The NTP statistics
section provides NTP statistics including feedback on sensor synchronization with the NTP server.
To verify the NTP configuration, follow these steps:
Step 1
Log in to the sensor.
Step 2
Generate the host statistics.
sensor# show statistics host
...
NTP Statistics
remote refid st t when poll reach delay offset jitter
11.22.33.44 CHU_AUDIO(1) 8 u 36 64 1 0.536 0.069 0.001
LOCAL(0) 73.78.73.84 5 l 35 64 1 0.000 0.000 0.001
ind assID status conf reach auth condition last_event cnt
1 10372 f014 yes yes ok reject reachable 1
2 10373 9014 yes yes none reject reachable 1
status = Not Synchronized
...
Step 3
Generate the hosts statistics again after a few minutes.
sensor# show statistics host
...
NTP Statistics
remote refid st t when poll reach delay offset jitter
*11.22.33.44 CHU_AUDIO(1) 8 u 22 64 377 0.518 37.975 33.465
LOCAL(0) 73.78.73.84 5 l 22 64 377 0.000 0.000 0.001
ind assID status conf reach auth condition last_event cnt
1 10372 f624 yes yes ok sys.peer reachable 2
2 10373 9024 yes yes none reject reachable 2
status = Synchronized
Step 4
If the status continues to read
Not Synchronized
, check with the NTP server administrator to make sure
the NTP server is configured correctly.
Correcting Time on the Sensor
If you set the time incorrectly, your stored events will have the incorrect time because they are stamped
with the time the event was created. The Event Store time stamp is always based on UTC time. If during
the original sensor setup, you set the time incorrectly by specifying 8:00 p.m. rather than 8:00a.m.,
when you do correct the error, the corrected time will be set backwards. New events might have times
older than old events.
For example, if during the initial setup, you configure the sensor as central time with daylight saving
time enabled and the local time is 8:04 p.m., the time is displayed as 20:04:37 CDT and has an offset
from UTC of -5 hours (01:04:37 UTC, the next day). A week later at 9:00 a.m., you discover the error:
the clock shows 21:00:23 CDT. You then change the time to 9:00 a.m. and now the clock shows
09:01:33 CDT. Because the offset from UTC has not changed, it requires that the UTC time now be
14:01:33 UTC, which creates the time stamp problem.