How to modify the date on a TIBCO LogLogic SEM appliance
Article ID: KB0077420
Updated On:
| Products | Versions |
|---|---|
| TIBCO LogLogic Security Event Manager | 2.7.x and higher |
Description
This article explains how to modify the date on a SEM appliance without losing the connection with the local SMA/Log Collector.
Issue/Introduction
This article explains how to modify the date on a LogLogic SEM appliance.
Resolution
Setting time and date into the past is not supported, e.g. date – 1 day.
Setting a date in the past causes problems with agents as well as problems with raw logs and elementary events. However, no problem will occur if you set time and date in the present or future.
If you set the time in the past:
- Use the SMPConfig (Database Administration menu).
- Click on "Delete all raw logs" and "Delete all elementary events”.
- Delete Archives if asked.
It is recommended to re-create a Web Console certificate. To do so, go to SMPConfig > menu Certificate management > SMP instance > select your instance > Create certificate.
Validation dates start on the day when the agent is installed. If the date is set too far into the past then the certificate is not valid.
To solve the problem with the agent, the installation certificate must be regenerated.
Here is the procedure without requiring an agent reinstall:
1. Stop the agent.
2. Delete the folder /folder_installation/conf/agent/INSTANCE
3. Go to the folder /folder_installation/conf/agent/
4. Unzip the installation file: unzip /tmp/INSTANCE.zip
5. Restart the agent.
For a local agent/log collector, a script can help.
/usr/local/exaprotect/esms-setup/scripts/others/reinstall_agent.pl INSTANCE
To set the time correctly, use an NTP server.
/etc/init.d/ntpd stop
ntpdate 192.168.11.101 (here, instead of the IP address, enter the ntp server)
/etc/init.d/ntpd start
Set the NTP server in the SMPConfig, menu "Operating system management", "NTP configuration".
Then the NTP server will do the rest.
Setting a date in the past causes problems with agents as well as problems with raw logs and elementary events. However, no problem will occur if you set time and date in the present or future.
If you set the time in the past:
- Use the SMPConfig (Database Administration menu).
- Click on "Delete all raw logs" and "Delete all elementary events”.
- Delete Archives if asked.
It is recommended to re-create a Web Console certificate. To do so, go to SMPConfig > menu Certificate management > SMP instance > select your instance > Create certificate.
Validation dates start on the day when the agent is installed. If the date is set too far into the past then the certificate is not valid.
To solve the problem with the agent, the installation certificate must be regenerated.
Here is the procedure without requiring an agent reinstall:
1. Stop the agent.
2. Delete the folder /folder_installation/conf/agent/INSTANCE
3. Go to the folder /folder_installation/conf/agent/
4. Unzip the installation file: unzip /tmp/INSTANCE.zip
5. Restart the agent.
For a local agent/log collector, a script can help.
/usr/local/exaprotect/esms-setup/scripts/others/reinstall_agent.pl INSTANCE
To set the time correctly, use an NTP server.
/etc/init.d/ntpd stop
ntpdate 192.168.11.101 (here, instead of the IP address, enter the ntp server)
/etc/init.d/ntpd start
Set the NTP server in the SMPConfig, menu "Operating system management", "NTP configuration".
Then the NTP server will do the rest.
Feedback
Yes
No
Powered by
