2024-05-10 10:44 AM
Here is the current situation. I admin Netwitness on 4 different networks and all are configured to use NTP. 3 of the networks are fine and keep time between the SA Head and other appliances w/no issue. However, on one network, all 8 NW devices have time that slowly deviates from NTP despite NTP being configured. Based off my rough calculations, time deviates from the NTP server time by about 10 seconds per day. I have to go into each of the 8 NW devices on this network and run the command to manually update time from the NTP server every few days, which is less than ideal and could cause issues if investigating any type of potential network event and using timestamps to determine cause. Any ideas on what could be causing this, or better yet, any corrective action?
2024-06-03 05:28 PM
Hello B_Hill,
When you run the command manually are you retrieving the time from the admin server or the NTP source that is configured on the admin server? I'm curious if there is a block somewhere. Is even the admin server time deviating?
2024-06-04 08:15 AM
Using the manual command to retrieve time from the NTP server. Yes, the admin server time is deviating and I believe that all other appliances are keeping time with the admin server due to the fact that they all deviate at the same rate. Suppose I could test that theory by just syncing the admin server and see if the others follow suit.
2024-06-04 09:53 AM
So, the admin server is the one with the issue. Once I manually sync the admin server to the NTP server, the others follow suit after a brief time period (I believe about 10 minutes or so).
2024-06-06 02:11 PM
Can you confirm that the NTPd service is running and pointing to an active NTP source? If it is pointing correctly, do you see any errors in /var/log/messages about communication issues?
Wednesday
Yes, I can confirm that NTPd service is active (running). It is also pointed correctly and not noticing anything about comm issues.