windows_exporter/docs/runbooks/windowsclockskewdetected.md

title

title
WindowsClockSkewDetected

Meaning

The absolute clock offset reported by Windows Time exceeds the configured threshold for ten minutes. The default is 0.05 seconds (50 ms). This opt-in alert requires the time collector with its ntp subcollector. The offset is relative to the selected source and does not independently validate that source's accuracy.

Impact

Clock skew can affect authentication, certificate validity, scheduled work, and the ordering of events across hosts. The default threshold is an early warning; application tolerances vary.

Diagnosis

1. Inspect windows_time_computed_time_offset_seconds, source count, and windows_time_ntp_round_trip_delay_seconds for the affected host.

2. Check synchronization state and the selected source:

   w32tm /query /status
   w32tm /query /source
   w32tm /query /configuration
   

3. Compare with a trusted source using w32tm /stripchart /computer:<trusted-time-server> /samples:5 /dataonly. Check source health, network delay, Windows Time-Service events, and domain or hypervisor time configuration.

4. Consult WindowsClockNotSynchronising when no NTP source is available.

Mitigation

Restore a healthy source and correct time configuration before requesting w32tm /resync /rediscover. Coordinate large clock corrections with application owners because abrupt changes can disrupt running workloads. Avoid setting the clock manually as a recurring fix. Confirm the reported offset decreases and remains within the application's required tolerance.