NTP Problem

[Yrma29]

Version

2.4.200

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

6

RAM

32

Storage for /

500

Storage for /nsm

300

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Hello everyone

After running so-setup on the sensors without internet connexion for adoption, the process status shows "Uknown" and CPU usage is at "100%", while the connection status shows "OK". The so-status command on the sensors shows that all services are running.

After deep checking I found that it's the NTP issue cause Time on the Manager Standalone and on Sensors is different. The sensors have the bad time.

So, knowing that the NTP on Manager is configured with the followings NTP Servers : 0.pool.ntp.org
1.pool.ntp.org, how to fix this issue so that sensors could get same time like on the Manager ?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

If you have a server on the network that can serve time, set the NTP in SOC > Administration > Configuration > ntp > config > NTP Servers to that server. If you don't, then you could use Salt to set the same time on all the servers https://docs.saltproject.io/en/3007/ref/modules/all/salt.modules.system.html#salt.modules.system.set_system_date_time It would be something like the example - sudo salt '*' system.set_system_date_time 2026 2 17 11 37 53 That would set the date/time on all the servers in the grid.

[Yrma29]

Thanks @cm-ops

So how to configure the Manager to become the NTP Server for all the sensors in the environnment ?

[cm-ops]

The nodes are running chronyd service. You could potentially use that. https://docs.oracle.com/en/operating-systems/oracle-linux/9/network/network-AboutthechronySuite.html#ol-nettime-chrony-about You would need to allow port 123 through the host firewall though.

If there is a network device that serves time already, it's easier to point to that device.