This article explains how to change NTP settings post installation for the various versions of code.

Time is not set correctly, NTP servers have changed, etc.

NTP stands for Network Time Protocol, and it is an Internet protocol that is used to synchronize the clocks of computers to some time reference. The JSA Console when configured with NTP, will get the most current time from the time reference source and then push updates hourly to all the Managed Hosts in the Deployment.

Important: Administrators should complete these procedures during scheduled maintenance. Updating the time server setting in JSA restarts services. This will log off users and interrupt event and flow collection until services restart.

For JSA  2013 through 2014.5:

1. 1. From any web browser, login to the webmin interface of the JSA Console by using the root credentials. For example: https://JSA IP Address:10000

2. 2. From the Managed Hosts Config drop-down, select System Time .

3. 3. Click the Time Server Sync tab.

4. 4. In the Timeserver hostnames or addresses field, type the hostname or IP address of your time server.

5. 5. Click Sync and Apply .

   Note : The sync and apply function restarts JSA services. This creates an interruption in event and flow collect and log off any existing users. Any reports in progress should be manually restarted.

For JSA 2014 [juniper.net].6 to 2014.8:

1. 1. Using SSH, log in to the JSA Console as the root user.

2. 2. To edit the ntp.conf file, type the following command: vi /etc/ntp.conf

3. 3. In the server section of the ntp.conf file, leave the existing server entries or replace them with your own internal Network Time Protocol (NTP) server. Server entries in the ntp.conf file begin with server. A list of public NTP servers is listed below:

     server 0.rhel.pool.ntp.org iburst
  server 1.rhel.pool.ntp.org iburst
  server 2.rhel.pool.ntp.org iburst
  server 3.rhel.pool.ntp.org iburst

   If you use public NTP servers, check that your firewall allows outbound NTP requests.

4. 4. Save the changes and close the file.

5. 5. Enable the ntpd service to run level 3.

     chkconfig --level 3 ntpd on

6. 6. Verify that the ntpd service is enabled to run at restart.

     chkconfig --list ntpd

   Verify that  3:on  displays in the output

     ntpd 0:off 1:off 2:off 3:on 4:off 5:off 6:off

7. 7. To prevent data collection errors when you change the system time, stop JSA services.

     service hostcontext stop
  service tomcat stop
  service hostservices stop

8. 8. Synchronize the time with your NTP server.

     ntpdate ntp.server.ipaddress

9. 9. Start the ntpd service.

     service ntpd start

10. 10. Restart JSA services

      service hostservices start
  service tomcat start
  service hostcontext start

11. 11. Synchronize the time on all managed hosts with your JSA Console:

      /opt/qradar/support/all_servers.sh /opt/qradar/bin/time_sync.sh

12. 12. On the Admin tab, click Advanced > Deploy Full Configuration to restart services on all JSA managed hosts.