Can LM verify a server's time is correct?

Hi,

We were asked if LM can check every server and alert if the server's time is off by more than ## seconds or whatever. This would need to be for Windows and Linux hosts. Does anyone know if this is possible out of the box?

I saw some things on the LM website about NTP monitoring. It made it sound like it's a standard for Linux servers by default, however I don't see it anywhere. And for Windows, the only thing I saw talked about looking through Event Viewer for certain entries.

I'm just looking for a basic module that will pull the time, compare it against LM's time or an NTP server, and alert if it's off (or something along those lines).

Thanks.

Kel L

Posted 1 year ago·Last reply 1 year ago

8 comments

Mike Moniz

·1 year ago

Yeah, that would be more precise since that would report the collector's time is wrong instead of saying the domain controller's time is wrong (assuming your also monitoring the domain controller in the first place).

What is the name of the Linux time time check module you are using, or did you custom write that one also?

Joe Williams

·1 year ago

Custom wrote it. Cloned a SSH module, we run ntpdate and pull back the reported seconds via awk/grep/tee or some such.

Mike Moniz

·1 year ago

For Windows, LM does have a built-in check which will "Shows the time offset of the monitored Windows Server relative to the collector" and can cover you here.

For other devices I do see NTP checks but they look to be more specific for NTP servers than clients.

I don't see a specific Linux time check. I'm not sure if it's because we are really only using snmp for Linux monitoring (vs say ssh), but it doesn't sounds like a big deal to add that monitoring if you are familiar with scripting.

Joe Williams

·1 year ago

Personally, we don't trust that built in one, as it just shows the drift in time between the server and the collector, both could be way outta whack but close to each other. But how do you alert when the collector is outta whack?

For windows we wrote a custom thing that uses w32tm. It runs and pulls back the offset from the one of the domain controllers and returns the offset in seconds.

And in linux we use SSH monitoring already so use the built in ntpdate,.

Kel L

OP1 year ago

I'm pretty new at writing my own DataSources, would you be willing to shar eyours? I created this Powershell script to poll time.windows.com 5 times and average the results, but I'm having trouble trying to turn that into a DataSource.

# Define time 
$timeServer = "time.windows.com"
$samples = 5
$offsets = @()

# Collect offset data
for ($i = 0; $i -lt $samples; $i++) {
    $output = w32tm /stripchart /computer:$timeServer /dataonly /samples:1 | Select-String "([\-\d\.]+)s"
    if ($output -match "([\-\d\.]+)s") {
        $offsets += [double]$matches[1]
    }
    Start-Sleep -Seconds 1
}

# Calculate average offset
if ($offsets.Count -gt 0) {
    $averageOffset = ($offsets | Measure-Object -Average).Average
    $averageOffset = [Math]::Abs($averageOffset)
    Write-Output $averageOffset
} else {
    Write-Output "Failed to retrieve time offsets."
}

Mike Moniz

·1 year ago

Most of that is good, you would want to add exit 0 after the average output, and exit 1 after the failed message.

But that only only covers the collector itself. DataSource scripts only run on the collector, so you would need to do something like Invoke-Command to have the remote system run the script on themselves, if you want to check systems. That may require extra setup on the remote systems to allow it.

But then again, once you confirm the collector's own time is correct, then perhaps he built-in one will help cover the rest.

Kel L

OP1 year ago

Here's what I get if I hard code one of my collectors into the script:

And the results:

It seems like it's trying to use the computername as a command for some reason. Let it's returning the correct results.

If I put $hostname into the invoke-command line, then I don't get any results at all.

Mike Moniz

·1 year ago

Put single quotes around ##HOSTNAME##. LM will do a literal search-and-replace of tokens. So it's thinking that your server name is a command and not a String.