mixin: group alerts by collector area and add alerts for default and opt-in collectors (#2777)

Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
2026-10-20 19:49:03 +02:00 · 2026-10-18 12:54:31 +02:00
parent eed518c3e1
commit d1b74b5ce3
104 changed files with 3751 additions and 302 deletions
@@ -0,0 +1,56 @@
+---
+title: WindowsClockSourceLocal
+---
+
+## Meaning
+
+Windows Time reports `Local CMOS Clock` or `NoSync` as the source of the system
+clock for ten minutes. The alert carries the source in its `type` label. It
+needs the `time` collector with its `clock_source` subcollector and covers
+domain members too, whose source is `NT5DS` when they synchronize from the
+domain hierarchy; the NTP source count of `WindowsClockNotSynchronising` does
+not see those hosts. A host that is meant to be the free-running reference of
+an isolated network reports the local clock by design; exclude it with
+`alerts+: { WindowsClockSourceLocal: false }` on that configuration.
+
+## Impact
+
+The clock drifts without an external source. Clock errors break Kerberos
+authentication beyond the five minute tolerance, TLS validation, scheduled
+work, log correlation and distributed systems that depend on time order.
+
+## Diagnosis
+
+1. Inspect `windows_time_clock_sync_source` for the host, and
+   `windows_time_computed_time_offset_seconds` to see how far the clock has
+   already drifted.
+2. On the host, check the configured and the effective source:
+
+   ```powershell
+   w32tm /query /source
+   w32tm /query /status
+   w32tm /query /configuration
+   Get-Service W32Time
+   ```
+
+3. `Local CMOS Clock` after a reboot often means the Windows Time service
+   started before the network was up or the configured peers were unreachable.
+   `NoSync` means the time provider is configured not to synchronize.
+4. For domain members, check that a domain controller is reachable and that
+   the PDC emulator synchronizes from an external source. For virtual machines,
+   check whether hypervisor time integration overrides the configured source.
+   A Hyper-V guest outside a domain that is kept in time by the integration
+   service reports `NoSync` while `w32tm /query /source` shows the
+   `VM IC Time Synchronization Provider`; that is by design, so turn the alert
+   off for such guests with `alerts+: { WindowsClockSourceLocal: false }` or
+   configure an NTP source in the guest.
+
+## Mitigation
+
+Configure the intended source and restart synchronization with
+`w32tm /config /syncfromflags:domhier /update` on domain members or
+`w32tm /config /manualpeerlist:"<servers>" /syncfromflags:manual /update` on
+stand-alone hosts, then `w32tm /resync /rediscover`. Fix network access to the
+peers over UDP port 123. Confirm the source changes to `NT5DS` or `NTP` and the
+offset returns to normal; follow [WindowsClockSkewDetected](../windowsclockskewdetected/)
+if it does not.