clock

Clock of a Windows, by SSH

Returns how far the clock of a Windows is from a time server: the offset with its sign (positive, the clock is ahead; negative, it is behind) and the same offset without its sign, in seconds. One watch is proposed, set on the probe.

How it works

The collector runs one PowerShell command that reads the clock of the Windows, then asks the time server named by the variable protocol:ntp:server for its time, by NTP. Without a value, the server is pool.ntp.org; an administrator who has a time server of his own sets it once, on the root of the tree.

powershell -NoProfile -NonInteractive -Command "[DateTime]::UtcNow.Ticks"

• The command returns the hundreds of nanoseconds since 1 January of the year 1 UTC, an integer, with no time zone and no culture to guess; every .NET serves it, that of Windows Server 2012 included.
• The poller notes its own clock before and after the SSH call, and when the time server answers. The server's time is brought back to the middle of the SSH call: the server's time, minus the time elapsed since then by the poller's clock. Neither the time between the two readings nor the error of the poller's own clock counts in the offset.
• The offset is the time of the Windows minus that reference, rounded to a tenth of a second; the offset without its sign is the one the watch judges.
• Nothing is skipped at the first run.
• When the time server does not answer, the collector stops as unreachable, with the message "Time server unreachable": it is the time server that failed, not the Windows.
• An answer that is not a number stops the collector as misconfigured.

Nothing is written to the Windows: the command only reads.

Prerequisites

• The OpenSSH server of Windows, installed and started: - on Windows Server 2019 and later, Windows 10 (version 1809 and later) and Windows 11, where it is built in: the optional feature "OpenSSH Server" (Settings, Optional features; or Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 in PowerShell), then the service sshd started and set to start automatically; - on Windows Server 2012, 2012 R2 and 2016, Windows 8, 8.1 and the earlier Windows 10, where it is not built in: OpenSSH for Windows installed from its Microsoft release (Win32-OpenSSH), then the service sshd started and set to start automatically.
• The default shell of the OpenSSH server left at cmd.exe, as it is installed: the collector starts PowerShell itself, and a command meant for cmd.exe would be read differently by a PowerShell default shell.
• Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
• An account for monitoring, without administrator rights, member of the local groups "Performance Monitor Users" and "Event Log Readers", so that the performance counters and the System log are not refused to it. banshee reads it in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key (the public key then in C:\Users\<account>.ssh\authorized_keys).
• The fingerprint of the server's host key, set in protocol:ssh:fingerprint (on the server, C:\ProgramData\ssh\ssh_host_ed25519_key.pub); not needed when the Security settings trust the first SSH fingerprint presented.
• The Windows firewall open to the poller on TCP 22 (the rule "OpenSSH SSH Server (sshd)", created with the feature).
• The poller able to reach the time server on UDP 123. A poller cut off from the internet needs protocol:ntp:server set to a time server it can reach.

Outputs

Watches

Limits

• The offset is read to about one second: the SSH call, connection and start of PowerShell included, is a second or two long, and the clock is read somewhere inside it. The default thresholds stay far above it.
• The time server is trusted: a time server that is itself wrong makes every clock look wrong. Point protocol:ntp:server at the server your machines synchronise with.