Time Synchronization Best Practices for Identity Suite and Database Servers - Identity Suite

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article addresses warning messages in the Identity Suite logs related to time discrepancies between the Identity Suite Virtual Appliance and the external database server. Ensuring accurate and synchronized time across all components is critical for maintaining session integrity, accurate auditing, and successful workflow execution.

Environment

Virtual Appliance 14.5

Cause

Identity Suite components, particularly the Identity Manager Workpoint engine, rely on precise time-stamping for transaction logs, session tokens, and automated tasks. When the database server time and the application server time diverge (clock drift), the system generates warnings and can experience authentication failures, task processing errors, or unexpected workflow behavior.

Resolution

To ensure system stability, implement the following steps:

1. Verify Clock Offset:
   • Compare the system time on the database server with the system time on all Virtual Appliance (vApp) nodes.
   • Use the date command on the Linux-based Virtual Appliance and the corresponding time command on your database host (e.g., SELECT sysdate FROM dual; for Oracle).
2. Configure NTP:
   • Enable the Network Time Protocol (NTP) on all Virtual Appliance nodes to ensure ongoing synchronization with a trusted time source.
   • Refer to the Identity Suite Virtual Appliance Documentation for detailed configuration steps.
3. Synchronize Database Host:
   • Ensure the database server is synchronized to the same NTP source as the Identity Suite nodes.
4. Validate Synchronization:
   • Restart the Identity Manager services if errors persist after synchronization to clear existing cached offsets.
   • Monitor the application logs to confirm the "time difference" warning messages are no longer appearing.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.