Updating the system time on the QRadar Console

Configure the system time on your QRadar® Console by setting the time manually, or by using NTP servers. The QRadar Console synchronizes its system time with the managed hosts in your deployment.

Procedure

  1. Click the Admin tab.
  2. In the System Configuration section, click the System and License Management icon.
  3. From the Display menu, select Systems.
  4. Select the relevant host.
  5. From the Actions menu, select View and Manage System, and then click the System Time tab.
  6. Select a time zone from the Time Zone menu.

    You can configure only the time zone on a managed host. The system time is synchronized with the QRadar Console but if the managed host is in a different time zone, then you can change to that time zone.

  7. To configure the system time manually, click Set time manually, and then set a date and a time.
    Exceptions:

    If you set the system time to a future date that is affected by Daylight Saving Time (DST) changes, the time you set is adjusted by one hour. For example, on 4 July 2020, in the US, you set the time and date to 20:00, 16 December 2020. The time that you set ignores the DST change and is adjusted to 19:00.



    When you set the system time on VMWare systems and then restart the system, the changes might be lost. To prevent the time changes from being lost you can edit the .vmx file on the virtual device to disable time synchronization, by adding the following lines to the synchronization properties:

    tools.syncTime = "FALSE" 
time.synchronize.continue = "FALSE" 
time.synchronize.restore = "FALSE" 
time.synchronize.resume.disk = "FALSE" 
time.synchronize.shrink = "FALSE" 
time.synchronize.tools.startup = "FALSE"
  8. To configure time by using NTP servers, click NTP Time Servers.
    1. Type an IP address or a host name for the NTP server in the Server 1 Address field.

      Host names are resolved by a DNS server.

    2. To add NTP servers, click the plus icon next to Add More.
  9. Click Save.
  10. Click OK to accept that services are restarted, or Cancel to cancel the changes.

    The services that are restarted include host context and tomcat.