How to modify the date on a TIBCO LogLogic SEM appliance

How to modify the date on a TIBCO LogLogic SEM appliance

book

Article ID: KB0077420

calendar_today

Updated On:

Products Versions
TIBCO LogLogic Security Event Manager 2.7.x and higher

Description

This article explains how to modify the date on a SEM appliance without losing the connection with the local SMA/Log Collector.

Issue/Introduction

This article explains how to modify the date on a LogLogic SEM appliance.

Resolution

Setting time and date into the past is not supported, e.g. date – 1 day.

Setting a date in the past causes problems with agents as well as problems with raw logs and elementary events. However, no problem will occur if you set time and date in the present or future.

If you set the time in the past:
-  Use the SMPConfig (Database Administration menu).
-  Click on "Delete all raw logs" and "Delete all elementary events”.
-  Delete Archives if asked.

It is recommended to re-create a Web Console certificate. To do so, go to SMPConfig > menu Certificate management > SMP instance > select your instance > Create certificate.


Validation dates start on the day when the agent is installed. If the date is set too far into the past then the certificate is not valid.

To solve the problem with the agent, the installation certificate must be regenerated.

Here is the procedure without requiring an agent reinstall:
1. Stop the agent.
2. Delete the folder /folder_installation/conf/agent/INSTANCE
3. Go to the folder /folder_installation/conf/agent/
4. Unzip the installation file: unzip /tmp/INSTANCE.zip
5. Restart the agent.


For a local agent/log collector, a script can help.
/usr/local/exaprotect/esms-setup/scripts/others/reinstall_agent.pl INSTANCE

To set the time correctly, use an NTP server.
/etc/init.d/ntpd stop
ntpdate 192.168.11.101 (here, instead of the IP address, enter the ntp server)
/etc/init.d/ntpd start

Set the NTP server in the SMPConfig, menu  "Operating system management", "NTP configuration".
Then the NTP server will do the rest.