Carbon Black Cloud: Alerts and Events showing future date/time (macOS)

[#1]

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• Apple macOS: All Supported Versions

Symptoms

• Some Alerts and Events in Console show future date and/or time
• Dates and/or times on previous and subsequent Alerts/Events are normal

Cause

Configuration changed locally to set system date & time manually

Resolution

Work with end-user to set date & time back to automatically update (using time.apple.com)

Additional Notes

• The Carbon Black Cloud Sensor reports the system date and time as it is set local to the machine and does not make any changes to those settings or the dates and times reported by the system
• Changes to system date & time can be checked using any of the following

  % grep --color='always' -ani -C 2 'settimeofday' /private/var/log/system.log
  
  OR
  
  % zgrep --color=always -aRni -C 2 'settimeofday' /private/var/log/
  
  OR
  
  % log show --info --predicate 'process == "timed" and eventMessage contains "settimeofday"'

Related Content

Carbon Black Cloud: How To Collect Sensor Logs Locally (Mac)
[Carbon Black Cloud] Using RepCLI on macOS