QRadar: Updating the system time on the QRadar Console using CLI

Steps

1. SSH to the QRadar Console
2. Check the current date and time of the system:
    

   # date
   Tue Oct  4 15:37:37 IST 2022
   

3.  Check the status of the NTP:
    

   # timedatectl status
     Local time: Tue 2022-10-04 15:39:54 IST
     Universal time: Tue 2022-10-04 10:09:54 UTC
     RTC time: Tue 2022-10-04 10:09:55
     Time zone: Asia/Kolkata (IST, +0530)
     NTP enabled: yes
     NTP synchronized: no
     RTC in local TZ: no
     DST active: n/a
4. If NTP is enabled, then turn it off:
    

   # timedatectl set-ntp false 

5. Run the timedatectl command on the Console to reset the date and time (the new date and time values are to be derived from a valid source):
    

   # timedatectl set-time "2022-10-04 15:41:00"

   NOTE: The time format to be used for the command is "<yyyy-mm-dd HH:mm:ss>". There is a possibility of some delay between when the time is observed (on the other source) and when the timedatectl command is run. It is best to keep the delay limited to about 30 seconds so that time-sensitive operations are not affected.
    

6. Set NTP back to enabled:

   # timedatectl set-ntp true

7. Stop and start the services on the Console:

   # systemctl stop tomcat
   # systemctl stop hostcontext
   # systemctl stop hostservices
   # systemctl start hostservices
   # systemctl start hostcontext
   # systemctl start tomcat

   
   ​

• Kindly perform the steps during downtime as all the services are stopped and started during the procedure, and the GUI is inaccessible till Tomcat is up.

• If you forgot to turn off the NTP and ran the command to reset the time, you get the 'Failed to set time' error:

  # timedatectl set-time "2022-10-04 15:39:00"
  
  Failed to set time: Automatic time synchronization is enabled