Configuring system time

Configure system time on your QRadar® Console by setting the time manually, or by using NTP servers to maintain the time. QRadar synchronizes the QRadar Console time with the managed hosts in your deployment.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. In the System Configuration section, click System and License Management.
  3. In the Display list, select Systems.
  4. Select the host for which you want to configure the system time settings.
  5. From the Actions menu, click View and Manage System.
  6. Click the System Time tab.
  7. To configure time on the QRadar Console, follow these steps:
    1. In the Time Zone list, select the time zone that applies to the QRadar Console.
    2. To manually configure the time, click Set time manually:, and then set the date and time for the console.
      Note: If you set the system time to a future date that is affected by Daylight Saving Time (DST) changes, the time you set is adjusted by 1 hour. For example, on 4 July 2016 in the U.S.A, you set the date to December 16, 2016 and the time to 8:00 PM. The time that you set ignores the DST change and is adjusted to 7:00 PM.
    3. To manage time by using NTP servers, follow these steps:
      1. Click Specify NTP Servers, and click Add More.
      2. In the Server 1 Address field, type an IP address or a host name for the NTP server. Host names are resolved by a DNS server.
  8. To configure time on a managed host, in the Time Zone list, select the time zone that applies to the host.

    On a managed host, you can configure only the time zone. The system time is synchronized with the QRadar Console but if the managed host is in a different time zone, then you can change to that time zone.

  9. Click Save.
  10. Click OK to accept that services are restarted, or Cancel to cancel the changes.

    Data collection for events and flows stops until the hostcontext and tomcat services are restarted.

What to do next

When you set the system time on VMware systems and then restart the system, the changes might be lost. To prevent the time changes from being lost, you can disable time synchronization on the virtual device by editing the virtual machine's configuration file and adding these lines to the synchronization properties:
tools.syncTime = "FALSE" 
time.synchronize.continue = "FALSE" 
time.synchronize.restore = "FALSE" 
time.synchronize.resume.disk = "FALSE" 
time.synchronize.shrink = "FALSE" 
time.synchronize.tools.startup = "FALSE"

The .vmx file is typically located in the directory where you created the virtual machine. For more information, see the vendor-specific documentation for your operating system.