Carbon Black Cloud: Alerts and Events showing future date/time (macOS)
book
Article ID: 289659
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Some Alerts and Events in Console show future date and/or time
Dates and/or times on previous and subsequent Alerts/Events are normal
Environment
Carbon Black Cloud Console: All Versions
Carbon Black Cloud Sensor: All Versions
Apple macOS: All Supported Versions
Cause
Configuration changed locally to set system date & time manually
Resolution
Work with end-user to set date & time back to automatically update (using time.apple.com)
Additional Information
The Carbon Black Cloud Sensor reports the system date and time as it is set local to the machine and does not make any changes to those settings or the dates and times reported by the system
Changes to system date & time can be checked using any of the following
% grep --color='always' -ani -C 2 'settimeofday' /private/var/log/system.log
OR
% zgrep --color=always -aRni -C 2 'settimeofday' /private/var/log/
OR
% log show --info --predicate 'process == "timed" and eventMessage contains "settimeofday"'