Review the SYSLOGS messages on the Admin tab to verify the time synchronization and the status for the capture network interface card on your IBM®-supplied appliance.
About this task
If the appliance is not supplied by IBM, you can use the external LED lights to verify
external time synchronization.
Procedure
- In a browser window, log in to the QRadar Network Packet Capture appliance as
an administrator.
The default password for the ADMIN account is pandion.
-
On the Admin tab, review the logs for a general message that indicates
that the time synchronization source changed, or that the SmartNIC obtained or
released the lock against the time source.
The following syntax is representative of a general
entry:
Adapter < number > time-sync status:
In-Sync: < Yes | No >
Current time-sync reference: < OsTime | PTP >
Skew (ns): < number >
Clock rate adjustment (ns): < number >
Clock Hard Reset: < Yes | No >
For example, a general time synchronization might look like this
entry:
Adapter 0 time-sync status:
In-Sync: Yes
Current time-sync reference: OsTime
Skew (ns): -1
Clock rate adjustment (ns): 503
Clock Hard Reset: No
-
If you are synchronizing against a Precision Time Protocol (PTP) primary, review the logs to
look for an extra entry that contains detailed information about the status of the adapter in PTP
mode.
The following syntax is representative of a PTP
entry:
Adapter < number > PTP time-sync status:
PTP Time: "--" | < PTP clock time > [ "(TAI)" ]
Port: < IPv4_address > | < IPv6_address > | "IEEE 802.3"
Link Status: < Down | 10M | 100M >
IPv4 Subnet Mask: < IPv4_address >
IPv4 Gateway: < IPv4_address >
DHCP Enabled: "Yes" | "No"
Profile Id: < six_times_2_hex digits >
Profile: < Default | Telecom | Power >
Clock Id: < six_times_2_hex digits >
Domain: < number > | "--"
VLAN: < number >
Delay Mechanism: "E2E", "P2P", "N/A"
PTP Filter: "Min", "PDV", "None", "N/A"
DelayAssemetry: < number >
Clock State: "Faulty" | "INACTIVE" | "SLAVE" | "--"
Mean Path Delay: <number>
GM Clock Identity: < 16_hex_digits >
For example, a PTP time synchronization might look like this log
entry:
Adapter 0 time-sync status:
Adapter 0 PTP time-sync status:
PTP Time: Thu 26-May-2016 12:44:03.123456789 (TAI)
Port: 192.168.3.77
Link Status: 100M
IPv4 Subnet Mask: 192.168.3.0
IPv4 Gateway: 192.168.3.1
DHCP Enabled: Yes
Profile Id: 00:1b:19:00:01:00
Profile: Default
Clock Id: 00:0d:e9:03:a2:aa
Domain: 0
VLAN: 0
Delay Mechanism: E2E
PTP Filter: None
Delay Assemetry: 0
Clock State: SLAVE
Mean Path Delay: 0
GM Clock Identity: 000de9fffe03a2aa