banshee/windows-collection/windows/snmp/clock

Clock of a Windows, by SNMP

Returns how far the clock of a Windows is from a time server: the offset with its sign (positive, the clock is ahead; negative, it is behind) and the same offset without its sign, in seconds. One watch is proposed, set on the probe.

Versions

Generic: written for the SNMP agent of Windows, the feature "SNMP Service" of Windows Server or the optional feature of Windows 10 and 11, and for HOST-RESOURCES-MIB, which it serves. That every release of Windows serves it alike is assumed, not yet checked on a real Windows.

How it works

The collector reads the system time of the Windows, hrSystemDate (1.3.6.1.2.1.25.1.2.0, HOST-RESOURCES-MIB), by SNMP, then asks the time server named by the variable protocol:ntp:server for its time, by NTP. Without a value, the server is pool.ntp.org; an administrator who has a time server of his own sets it once, on the root of the tree.

The poller notes its own clock before and after the SNMP read, and when the time server answers. The server's time is brought back to the middle of the SNMP read: the server's time, minus the time elapsed since then by the poller's clock. Neither the SNMP round trip, nor the time between the two reads, nor the error of the poller's own clock counts in the offset: only differences of the poller's clock come in.
The offset is the time of the Windows minus that reference, rounded to a tenth of a second; the offset without its sign is the one the watch judges.
Nothing is skipped at the first run: the offset comes at once.
When the time server does not answer, the collector stops as unreachable, with the message "Time server unreachable": it is the time server that failed, not the Windows.
When the Windows does not answer SNMP, the collector stops as unreachable, as every SNMP collector does.

Nothing is written to the Windows: SNMP reads only.

Prerequisites

The SNMP service of Windows, installed and started: - on Windows Server, the feature "SNMP Service" (Server Manager, Add Roles and Features; or Install-WindowsFeature SNMP-Service in PowerShell); - on Windows 10 and 11, the optional feature "Simple Network Management Protocol (SNMP)" (Settings, Optional features; or Add-WindowsCapability -Online -Name SNMP.Client~~~~0.0.1.0 in PowerShell).
In the properties of the service "SNMP Service", tab Security: - a community with the right READ ONLY, which banshee reads in protocol:snmp:v2c:community; - under "Accept SNMP packets from these hosts", the address of the poller.
SNMPv3: the SNMP agent of Windows does not offer it; protocol:snmp:version stays v2c. The community then travels in clear text: keep it read-only and accepted from the poller alone.
The Windows firewall open to the poller on UDP 161 (the rule "SNMP Service (UDP In)").
The poller able to reach the time server on UDP 123. A poller cut off from the internet needs protocol:ntp:server set to a time server it can reach.

Outputs

Name	Label	Unit	Per instance
`offset`	Offset from the time server	s	no
`drift`	Offset, without its sign	s	no

Watches

Name	Title	Kind	Defaults	Checked by default
`clock-drift`	Clock off	above a threshold, on `drift`	warning above 5 s, critical above 60 s, from the first run	yes

Limits

hrSystemDate is precise to a tenth of a second: a smaller offset is not seen.
Not yet checked on a real Windows: the form in which its agent serves hrSystemDate. The SNMP date has two forms, 8 bytes without the offset from UTC, or 11 bytes with it. Served in 8 bytes, it does not say which instant it is: the collector then stops as misconfigured at every run, saying so, rather than guess an offset.
The time server is trusted: a time server that is itself wrong makes every clock look wrong. Point protocol:ntp:server at the server your machines synchronise with.