topic Re: Log Time difference in Firewall and Security Management

Log Time difference

Gomboragchaa — Wed, 15 Aug 2018 06:04:11 GMT

I have Management R80.10 take 121. Times in logs is one hour late.

I tried sk61941 but no success, enabling NTP didn't help.

When running #hwclock --systohc time is synchronized but not the logs timestamp.

We using few time based rules. Time issue affected rules also.

It looks like there is a bug.

Is there any information if this is bug or maybe I am doing something wrong?

Re: Log Time difference

_Val_ — Wed, 15 Aug 2018 06:36:28 GMT

Log time stamps could be affected by log server own timezone. Please make sure both MGMT and GWs are configured the same way and show the same local time and time zone.

Also, why are you using ULAST? ULAT should be good enough.

Re: Log Time difference

Gomboragchaa — Wed, 15 Aug 2018 07:49:16 GMT

Thank you for reply,

It is stand-alone deployment. I tried with ntp and without ntp. Unfortunately still 1 hour late on log...

ULAST and ULAT is the almost same. It is syncing from official local time server.

Timezone is not important . We can change it.

Re: Log Time difference

_Val_ — Wed, 15 Aug 2018 07:52:38 GMT

Try changing it to ULAT and if this does not help, please open a support request with TAC

Re: Log Time difference

Gomboragchaa — Wed, 15 Aug 2018 10:20:39 GMT

I contacted TAC engineer. Then TAC engineer received answer from R&D.

It is expected issue and they haven't any plan to fix next jumbo hotfix. Also they will solve on R80.20.

Unbelievable...

Re: Log Time difference

Tomer_Sole — Wed, 15 Aug 2018 10:40:08 GMT

Hi,

I apologize for the phrasing of the response by our Support.

There are certain fixes we just cannot do for jumbo updates of a version. Jumbo fixes are stability fixes. If there is a bigger risk level involved, we choose to delay the fix and bundle it with a version upgrade, for quality reasons. I hope that you understand.

With the recent change in strategy of issuing a security management version more frequently (see: R80.20.M1 and the next ones) this means more solutions will be on a maintrain release than before.

Re: Log Time difference

_Val_ — Wed, 15 Aug 2018 10:43:53 GMT

Tomer, could you please advise how to fix or work it around meanwhile?

Re: Log Time difference

Tomer_Sole — Wed, 15 Aug 2018 10:49:24 GMT

Sorry i don't have the details here. It is probably better to ask on that TAC case if there is a workaround that can be done.

Re: Log Time difference

_Val_ — Wed, 15 Aug 2018 10:50:47 GMT

Okay, I will follow up myself

Re: Log Time difference

Gomboragchaa — Wed, 15 Aug 2018 10:52:34 GMT

Thank you for your information.

That issue should be fine for me. But I spend 2 days on this issue.

I think Check Point need to release any official statement on every known bug...

Re: Log Time difference

JozkoMrkvicka — Wed, 15 Aug 2018 19:42:21 GMT

oh, Check Point doesnt have such a resources for that... update it every 30 minutes with new bugs 😮

Just wait for R80.30 and till then enjoy R77.30.

Re: Log Time difference

_Val_ — Thu, 16 Aug 2018 10:35:10 GMT

At Check Point, we appreciate your opinion. Let me just say that we take quality of our products very seriously. If you have any particular request or suggestion, feel free to contact me directly at any time.

Thank you

Re: Log Time difference

jakrub — Mon, 29 Apr 2019 10:47:13 GMT

hello Valeri,
i would like to ask you if there is any new info about this issue. Our customer also has this problem with R80.10 and we would be interested in workaround for now.
Thank you,
JR

Re: Log Time difference

Baasanjargal_Ts — Mon, 14 Oct 2019 07:46:24 GMT

Is there any way to fix it on R80.10 distributed deployment.? Traffic log shows one hour behind real world time.

Re: Log Time difference

Baasanjargal_Ts — Mon, 14 Oct 2019 07:50:41 GMT

Is there any update.?
In R80.10 Distributed deployment, There is one hour variation. Is there any way to fix it.

Re: Log Time difference

Dror_Aharony — Thu, 31 Oct 2019 12:20:57 GMT

Fixed on latest Jumbo-HF take (take 225 now):

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380&partition=General&product=Security

Re: Log Time difference

Dror_Aharony — Sun, 03 Nov 2019 08:30:30 GMT

Correction: only fixed to JumboHF ongoing take 245 (not yet the public one):

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380&partition=General&product=Security