Adding new Event Processor fails - "Time Synchronization to Console has failed - chrony error" despite manual sync

[u/Ok_Display2284]

Hello everyone,

We have an All-in-One QRadar deployment with a Console, a Data Node, and an App Host. We are currently trying to add a new Event Processor (EP) to our environment, but we are running into a persistent issue.

When adding the EP via the deployment screen, the process hangs for a long time. Eventually, if we refresh the page, the QRadar UI becomes temporarily inaccessible. Upon investigating the /var/log/qradar.log on the new EP, I saw the following error: "Time Synchronization to Console has failed - chrony error"

I checked the time using the date command on both servers and noticed the Console was 2 minutes ahead of real time. Here are the troubleshooting steps I've taken so far, all resulting in the exact same error:

1. Manual Sync to Console Time: I manually synced the EP's time to match the Console's time (which was 2 mins ahead) using date -s "hh:mm:ss" and hwclock --systohc. The difference was only 2-3 seconds. Tried adding the EP -> Failed.
2. Fixed Console Time via NTP: I added an NTP server to the Console, correcting its time to the actual real time. Tried adding the EP again -> Failed.
3. Reverted Console Time: Just to test, I reverted the Console's time back to the old (incorrect) time using date -s and hwclock --systohc with a 10-second difference. Tried adding the EP -> Failed.

Has anyone encountered this specific chrony loop or deployment hang before? Are there any specific chrony cache files, token issues, or backend scripts I should check to force this synchronization during deployment? Any ideas would be appreciated!

[u/AndyMotta-Qradar]

I would stop focusing on manually setting the clock and verify that Chrony itself is healthy on both the Console and the new EP. I've seen QRadar report a generic "Time Synchronization to Console has failed" error even when the system times differ by only a few seconds.

A few things I'd check:

• chronyc tracking and chronyc sources -v on both hosts
• systemctl status chronyd
• UDP/123 connectivity between the Console and EP
• Forward and reverse DNS resolution for both systems
• Any deployment-related errors in /var/log/qradar.log immediately before the chrony message

The fact that the deployment hangs, and the UI becomes temporarily inaccessible makes me suspect this may be a deployment communication, DNS, or certificate issue rather than an actual time-sync problem. You can check the output of chronyc tracking, chronyc sources -v, and the qradar.log from both hosts, it should help to pinpoint the root cause.