Expert
ProfessorPersonally, we don't trust that built in one, as it just shows the drift in time between the server and the collector, both could be way outta whack but close to each other. But how do you alert when the collector is outta whack?
For windows we wrote a custom thing that uses w32tm. It runs and pulls back the offset from the one of the domain controllers and returns the offset in seconds.
And in linux we use SSH monitoring already so use the built in ntpdate,.
ExpertI'm pretty new at writing my own DataSources, would you be willing to shar eyours? I created this Powershell script to poll time.windows.com 5 times and average the results, but I'm having trouble trying to turn that into a DataSource.
# Define time
$timeServer = "time.windows.com"
$samples = 5
$offsets = @()
# Collect offset data
for ($i = 0; $i -lt $samples; $i++) {
$output = w32tm /stripchart /computer:$timeServer /dataonly /samples:1 | Select-String "([\-\d\.]+)s"
if ($output -match "([\-\d\.]+)s") {
$offsets += [double]$matches[1]
}
Start-Sleep -Seconds 1
}
# Calculate average offset
if ($offsets.Count -gt 0) {
$averageOffset = ($offsets | Measure-Object -Average).Average
$averageOffset = [Math]::Abs($averageOffset)
Write-Output $averageOffset
} else {
Write-Output "Failed to retrieve time offsets."
}
ProfessorMost of that is good, you would want to add exit 0 after the average output, and exit 1 after the failed message.
But that only only covers the collector itself. DataSource scripts only run on the collector, so you would need to do something like Invoke-Command to have the remote system run the script on themselves, if you want to check systems. That may require extra setup on the remote systems to allow it.
But then again, once you confirm the collector's own time is correct, then perhaps he built-in one will help cover the rest.
ExpertHere's what I get if I hard code one of my collectors into the script:
And the results:
It seems like it's trying to use the computername as a command for some reason. Let it's returning the correct results.
If I put $hostname into the invoke-command line, then I don't get any results at all.
ProfessorPut single quotes around ##HOSTNAME##. LM will do a literal search-and-replace of tokens. So it's thinking that your server name is a command and not a String.
