Jan-Otto Kröpke
d819362150
Every optional collector of the mixin now has alerts, generated only with that collector enabled in _config.collectors: clock source, disk drive status, page file usage, license status, scheduled task results, pending updates, Hyper-V WMI and replication health, failover cluster nodes, resources, groups and shared volumes, Storage Spaces pool and virtual disk health, DHCP scope exhaustion and DNS zone transfer failures. The alerts of the pagefile, diskdrive and license collectors join the memory, disk and system groups; the other collectors get a group of their own. New knobs: taskSelector, sharedVolumeSelector, pagefileUsageThreshold, dhcpScopeFreeWarningThreshold, dhcpScopeFreeCriticalThreshold and updatePendingDuration. The test configuration enables every optional collector and tests/optional.test.yaml covers the new alerts. Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
2.5 KiB
title
| title |
|---|
| WindowsClockSourceLocal |
Meaning
Windows Time reports Local CMOS Clock or NoSync as the source of the system
clock for ten minutes. The alert carries the source in its type label. It
needs the time collector with its clock_source subcollector and covers
domain members too, whose source is NT5DS when they synchronize from the
domain hierarchy; the NTP source count of WindowsClockNotSynchronising does
not see those hosts. A host that is meant to be the free-running reference of
an isolated network reports the local clock by design; exclude it with
alerts+: { WindowsClockSourceLocal: false } on that configuration.
Impact
The clock drifts without an external source. Clock errors break Kerberos authentication beyond the five minute tolerance, TLS validation, scheduled work, log correlation and distributed systems that depend on time order.
Diagnosis
-
Inspect
windows_time_clock_sync_sourcefor the host, andwindows_time_computed_time_offset_secondsto see how far the clock has already drifted. -
On the host, check the configured and the effective source:
w32tm /query /source w32tm /query /status w32tm /query /configuration Get-Service W32Time -
Local CMOS Clockafter a reboot often means the Windows Time service started before the network was up or the configured peers were unreachable.NoSyncmeans the time provider is configured not to synchronize. -
For domain members, check that a domain controller is reachable and that the PDC emulator synchronizes from an external source. For virtual machines, check whether hypervisor time integration overrides the configured source. A Hyper-V guest outside a domain that is kept in time by the integration service reports
NoSyncwhilew32tm /query /sourceshows theVM IC Time Synchronization Provider; that is by design, so turn the alert off for such guests withalerts+: { WindowsClockSourceLocal: false }or configure an NTP source in the guest.
Mitigation
Configure the intended source and restart synchronization with
w32tm /config /syncfromflags:domhier /update on domain members or
w32tm /config /manualpeerlist:"<servers>" /syncfromflags:manual /update on
stand-alone hosts, then w32tm /resync /rediscover. Fix network access to the
peers over UDP port 123. Confirm the source changes to NT5DS or NTP and the
offset returns to normal; follow WindowsClockSkewDetected
if it does not.