IBM Support

QRadar: Force time synchronization to resolve "Time Synchronization to Console has failed - tlsdate error"

Troubleshooting


Problem

As of version 7.3.0, QRadar uses tlsdate to synchronize time. This article overviews how time is synchronized and how to force time synchronization when the console reports the incorrect time.

Symptom

Offenses that are generated with an end time that occurs in the future or other time-related anomalies in the console.

Diagnosing The Problem

If the time or date of a Managed Host changed unexpectedly, you can review the error logs at /var/log/qradar.error of the QRadar managed host appliance and look for synchronization messages like the following:

[hostcontext.hostcontext]: [ERROR] [NOT:0150003100] Time Synchronization to Console 
has failed - tlsdate error

Resolving The Problem

How time synchronization works

QRadar uses tlsdate to synchronize time between managed hosts and the console. It makes an HTTPS request to Apache on the console by using port 443 and uses that response to set the time. Syncing between the secondary and the primary is done by using SSH over port 22. This activity occurs every 10 minutes by default as a cron job as time_sync.sh. Time synchronization is critical in QRadar as it defines search parameters.

Steps

  1. SSH into the QRadar console
  2. Enter the following command to force time synchronization: 
    /usr/bin/tlsdate -P sslv23 -s -V -v -H <console_ip> -w
    Important: If you run the command without a -w flag on QRadar Versions 7.3.1+, it causes ecs-ec-ingress to experience issues starting.

    Result
    The console displays the correct time. If you continue to experience issues contact support.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.0;7.3.1;7.3.2;7.3.3;7.4.0;7.4.1;7.4.2;7.4.3;7.5.0;and future releases"}]

Document Information

Modified date:
08 February 2023

UID

ibm10725933

Page Feedback