JSA System Time

Problems That Are Caused by Mismatched Time Zones

To ensure that searches and data-related functions work properly, all appliances must synchronize time settings with the JSA console appliance. When the time zone settings are mismatched, you might see inconsistent results between JSA searches and report data.

The Accumulator service runs on all appliances with local storage to create minute by minute accumulations, and hourly and daily roll ups. JSA uses the accumulated data in reports and time series graphs. When the time zones are mismatched in a distributed deployment, report and time series graphs might show inconsistent results when compared to AQL query results due to the way that the accumulated data is aggregated.

JSA searches run against data that is stored in the Ariel databases, which use a date structure (YYYY/MM/DD/HH/MM) to store files to disk. Changing the time zone after the data is written to disk disrupts the file naming sequence in the Ariel databases and might cause data integrity problems.

Configuring System Time

Configure system time on your JSA console by setting the time manually, or by using NTP servers to maintain the time. JSA synchronizes the JSA console time with the managed hosts in your deployment.

1. On the navigation menu (), click Admin.

2. In the System Configuration section, click System and License Management.

3. In the Display list, select Systems.

4. Select the host for which you want to configure the system time settings.

5. From the Actions menu, click View and Manage System.

6. Click the System Time tab.

7. To configure time on the JSA console, follow these steps:

   1. In the Time Zone list, select the time zone that applies to the JSA console.

   2. To manually configure the time, click Set time manually:, and then set the date and time for the console.

      Note:

      If you set the system time to a future date that is affected by Daylight Saving Time (DST) changes, the time you set is adjusted by 1 hour. For example, on 4 July 2016 in the U.S.A, you set the date to December 16, 2016 and the time to 8:00 PM. The time that you set ignores the DST change and is adjusted to 7:00 PM.

   3. To manage time by using NTP servers, follow these steps:

      1. Click Specify NTP Servers, and click Add More.

      2. In the Server 1 Address field, type an IP address or a host name for the NTP server. Host names are resolved by a DNS server.

8. To configure time on a managed host, in the Time Zone list, select the time zone that applies to the host.

   On a managed host, you can configure only the time zone. The system time is synchronized with the JSA console but if the managed host is in a different time zone, then you can change to that time zone.

9. Click Save.

10. Click OK to accept that services are restarted, or Cancel to cancel the changes.

    Data collection for events and flows stops until the hostcontext and tomcat services are restarted.

When you set the system time on VMware systems and then restart the system, the changes might be lost. To prevent the time changes from being lost, you can disable time synchronization on the virtual device by editing the virtual machine's configuration file and adding these lines to the synchronization properties:

The .vmx file is typically located in the directory where you created the virtual machine. For more information, see the vendor-specific documentation for your operating system.