Clock set incorrectly-cisco-nxos
Vendor: cisco
OS: nxos
Description:
indeni will trigger an issue when a device’s clock is more than 24 hours off of Indeni’s clock.
Remediation Steps:
Consider setting the date on the device and activating NTP.
||1. Execute the “show clock” command to check the system time.
|2. Consider setting the date on the device by activating NTP.
|3. For more information please review: Cisco NX-OS NTP configuration guide
How does this work?
This script logs into the Cisco Nexus switch using SSH and retrieves the current time using the output of the “show clock” command. The output includes the device’s current date and time as well as configured time zone.
Why is this important?
Capture the current date and time of the device. Device current date and time should never be more than 24 hours away from date and time of the device polling the data, otherwise date and time are not correctly set on device.
Without Indeni how would you find this?
It is possible to poll this data through SNMP.
nexus-show-clock
name: nexus-show-clock
description: Nexus show clock
type: monitoring
monitoring_interval: 5 minutes
requires:
vendor: cisco
os.name: nxos
comments:
current-datetime:
why: "Capture the current date and time of the device. Device current date\
\ and time should never be more than 24 hours away from date and time\
\ of the device polling the data, otherwise date and time are not correctly\
\ set on device. \n"
how: |
This script logs into the Cisco Nexus switch using SSH and retrieves the current time using the output of the "show clock" command. The output includes the device's current date and time as well as configured time zone.
can-with-snmp: true
can-with-syslog: false
timezone:
why: |
Capture the time zone setting of the device. Time zone denotes offset from Coordinated Universal Time (UTC).
how: |
This script logs into the Cisco Nexus switch using SSH and retrieves the configured time zone using the output of the "show clock" command. The output includes the current time and configured time zone, i.e. EST for Eastern Standard Time.
If the time zone is mismatched across vPC domain (cluster) members an alert will be triggered.
can-with-snmp: false
can-with-syslog: false
steps:
- run:
type: SSH
command: show clock
parse:
type: AWK
file: show_clock.parser.1.awk
cross_vendor_clock_off
package com.indeni.server.rules.library.core
import com.indeni.apidata.time.TimeSpan
import com.indeni.apidata.time.TimeSpan.TimePeriod
import com.indeni.ruleengine.expressions.conditions.GreaterThan
import com.indeni.ruleengine.expressions.core._
import com.indeni.ruleengine.expressions.data._
import com.indeni.ruleengine.expressions.math.{AbsExpression, MinusExpression}
import com.indeni.ruleengine.expressions.utility.NowExpression
import com.indeni.server.common.data.conditions.True
import com.indeni.server.rules._
import com.indeni.server.rules.library.{ConditionalRemediationSteps, PerDeviceRule, RuleHelper}
import com.indeni.server.sensor.models.managementprocess.alerts.dto.AlertSeverity
case class ClockOffRule() extends PerDeviceRule with RuleHelper {
override val metadata: RuleMetadata = RuleMetadata
.builder(
"cross_vendor_clock_off",
"Clock set incorrectly",
"indeni will trigger an issue when a device's clock is more than 24 hours off of Indeni's clock.",
AlertSeverity.ERROR,
categories = Set(RuleCategory.HealthChecks),
deviceCategory = DeviceCategory.AllDevices
)
.build()
override def expressionTree(context: RuleContext): StatusTreeExpression = {
val actualValue = TimeSeriesExpression[Double]("current-datetime").last.toTimeSpan(TimePeriod.SECOND)
StatusTreeExpression(
// Which objects to pull (normally, devices)
SelectTagsExpression(context.metaDao, Set(DeviceKey), True),
// What constitutes an issue
StatusTreeExpression(
// The time-series we check the test condition against:
SelectTimeSeriesExpression[Double](context.tsDao, Set("current-datetime"), denseOnly = false),
// The condition which, if true, we have an issue. Checked against the time-series we've collected
GreaterThan(AbsExpression(MinusExpression(NowExpression(), actualValue)),
ConstantExpression(Some(TimeSpan.fromDays(1))))
// The Alert Item to add for this specific item
).withRootInfo(
getHeadline(),
scopableStringFormatExpression("The current date/time on this device is: %s which seems to be incorrect.",
timeSpanToDateExpression(actualValue)),
ConditionalRemediationSteps(
"Consider setting the date on the device and activating NTP.",
RemediationStepCondition.VENDOR_CISCO ->
"""1. Execute the "show clock" command to check the system time.
|2. Consider setting the date on the device by activating NTP.
|3. For more information please review: <a target="_blank" href="https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/system_management/configuration/guide/sm_nx_os_cg/sm_3ntp.pdf">Cisco NX-OS NTP configuration guide</a>""".stripMargin,
RemediationStepCondition.VENDOR_JUNIPER ->
"""|1. Run "show system uptime" command to review current time and time source.
|2. The current date and time should not be 24 hours off from the polling date and time.
|3. Set the correct date and time.
|4. Consider activating NTP for time synchronization.
|5. Review the following article on Juniper tech support site: <a target="_blank" href="https://kb.juniper.net/InfoCenter/index?page=content&id=KB15756&actp=METADATA">Configure Time and NTP Client</a>
|6. If the problem persists, contact the Juniper Networks Technical Assistance Center (JTAC).""".stripMargin
)
)
.asCondition()
).withoutInfo()
}
}