OKM - Delta Time Between The NTP Server And The KMA Is More Than 5 Minutes

Asset ID:	1-72-1612940.1
Update Date:	2014-01-10
Keywords:

Solution Type Problem Resolution Sure

Solution 1612940.1 : OKM - Delta Time Between The NTP Server And The KMA Is More Than 5 Minutes

Applies to:

Oracle Key Manager - Version 2.1 to 2.5.2 [Release 2.0]
Information in this document applies to any platform.

Symptoms

KMA's server is reporting different time than the NTP server and other KMA's in the cluster.

Example of error messages in the audit log:
48A14441938DE0A30000000000A00BDA 48A14441938DE0A3 tx2kmopm02 Local Management Operations Medium Term Retention Update NTP Peers Delta time between the NTP server and the KMA is more than 5 minutes Error 000248000345 2014-01-02 21:13:48.202392+00 NTP Server = 171.174.3.251, Adjustment, or offset, in Seconds = -311, Reason = NTP server and KMA time differ by more than 5 minutes Contact Customer Support and gather a system dump if possible

Example of error messages in the system dump's messages.log file:
Jan 2 21:13:48 tx2kmopm02 OKM: [ID 835238 local7.error] Update NTP Peers Delta time between the NTP server and the KMA is more than 5 minutes NTP Server = 171.174.3.251, Adjustment, or offset, in Seconds = -311, Reason = NTP server and KMA time differ by more than 5 minutes Contact Customer Support and gather a system dump if possible

The system dump's svcs.txt file shows NTP service is disabled:
svcs.txt:disabled Nov_19 svc:/network/ntp:default

Changes

No known change in the system

Cause

The NTP service is not online on this KMA

Solution

1. Connect to the OKM Manager as Security Officer

2. Adjust the time by going to the System Management -> System Time screen and click on the Adjust Time button.
  The KMA system time can be adjusted only once a day by a maximum of 5 minutes forward or backward.

3. If the Adjust Time button is disabled, the KMA's system time is synchronized with an NTP server.

    If the NTP service is disabled, do the following:
     a. Remove the NTP Server entry by clicking on "Delete NTP Server" button.
     b. Wait about 5 to 10 minutes for the KMA to sync up with the system time.
     c. Then, click on the "Specify NTP Server" button to specify the same NTP server IP address that was removed earlier
     d. Wait about 5 to 10 minutes for the KMA to sync up with the NTP server's system time.

    If the KMA cannot communicate with the NTP server, do the following:
      a. Remove the NTP Server entry by clicking on "Delete NTP Server" button.
    b. Wait about 5 to 10 minutes for the KMA to sync up with the system time.
      c. Adjust the time by going to the System Management -> System Time screen and click on the Adjust Time button.
         The KMA system time can be adjusted only once a day by a maximum of 5 minutes forward or backward.

4. Verify the Audit log to see if the NTP error messages are still occurring.
  If they are, open a service request in MyOracle Support.

Attachments

This solution has no attachment