cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post

Server Clock Drift (PowerShell)

The template allows you to check the server clock drift by comparing the target server time with internet time.

Prerequisites: None.

Credentials: Administrator on the target server.


Component Monitors

Clock Drift (Internet Time Service)

This monitor shows the clock drift between the target client (target node) and the target Internet Time Service server (argument) in seconds. Positive values of clock drift in the message field indicates that the time on the target server is running faster than it should. Negative values indicate time on the target server is running slower than it should. This monitor also returns the current time on the target server. 

In the Scripts Arguments field you should provide the hostname of the time server. Time servers can be found here: http://tf.nist.gov/tf-cgi/servers.cgi.

Following is an example of how to use the Scripts Arguments field:

time.nist.gov

Clock Drift (NTP)

This monitor shows the clock drift between the target client (target node) and the target NTP server (argument) in seconds. Positive values of clock drift in the message field indicates that time on the target server is running faster than it should. Negative values indicates time on the target server is running slower than it should.

In the Scripts Arguments field you should provide the hostname of the NTP server. Time servers can be found here: http://www.pool.ntp.org/.

Following is an example of how to use the Scripts Arguments field:

pool.ntp.org


Portions of this document were originally created by and are excerpted from the following sources:

Microsoft Corporation, “Microsoft Support:  Windows Management Framework Core,” Copyright © 2012 Microsoft Corporation.  All rights reserved. Available at http://support.microsoft.com/kb/968930.
PowerShell.com, “Set Internet Time,” Copyright © 2011-2012 PowerShell.com.  All rights reserved. Available at
http://powershell.com/cs/media/p/9869.aspx.
Cardiff University, “Using the Time Service,” Copyright © 2012
.  All rights reserved. Available at http://www.cs.cf.ac.uk/Dave/PERL/node174.html.

Last updated: 11/19/2014 (Rounding error fixed)

Labels (1)
Attachments
Comments

That's similar to the APM that I made here:

http://thwack.solarwinds.com/docs/DOC-147724

What ended up being more useful for us was this variation that didn't require any changes on the remote host.  The PowerShell runs locally on the poller, queries an NTP time server, queries the remote system over WMI, and then does a comparison to find the skew on the remote system. The upshot is that it works with any server that can be queried via WMI.  It is available here:

http://thwack.solarwinds.com/docs/DOC-147721

This monitor works great but I have one concern/question: How does the component threshold settings for critical and warning handle both positive AND negative values?

The description of the monitor states the following: "Positive values of clock drift in the message field indicates that the time on the target server is running faster than it should. Negative values indicate time on the target server is running slower than it should." This means the output can be either a positive or negative value.

However the threshold settings for any component allow only greater than or less than values. So in the use case where the statistic output can return a positive AND a negative value the threshold value can only be configured to trigger on positive OR negative value. What is the best way to handle this?

You would need to copy/duplicate the component and define different thresholds (one greater than, the other less than).

Turns out I was wrong. This PowerShell script returns an absolute integer for the statistic and the actual value in the message.

This is what it looks like when the target server's time is behind the NTP time.

pastedImage_1.png

pastedImage_2.png

This is what it looks like when the target server's time is ahead of the NTP time.

pastedImage_7.png

pastedImage_4.png

This means you can use a single threshold for both positive and negative outcomes. Who ever wrote this script is very smart. Thank you.

Hi All,

I am getting the below error while using the Clock drift monitor :

Errors: ==============================================
Cannot convert value "error ERROR_TIMEOUT - no re" to type "System.Double". Error: "Input string was not in a correct format."
At line:26 char:9
+ $Skew = $remoteToSolarSkew.TotalSeconds - $ntpToSolarSkew;
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvalidCastFromStringToDoubleOrSingle

You cannot call a method on a null-valued expression.
At line:27 char:2
+ $symb=$Skew.ToString().Substring(0,1);
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull


Can you provide any additional details about your environment. Feel free to message me independently if you like.

Hi All,

We are receiving the below error intermittently using the Clock Drift monitor:

PowerShell script error. Scripting Error: Script does not contain the expected parameters or is improperly formatted. 'Statistic' missing

Does anybody know about this?

Thanks.

pastedImage_0.png

Here is the screenshot of the error we are getting. The application goes in unknown state intermittently.

Hi stevenwhunt,

We have a router which takes time from the internet, which is then sync'd to domain controllers.

When, Script argument = ntp.domain.xxx <the NTP Server, its a Cisco Router, polled via SNMP>

and the target node is a Primary Domain Controller< a Windows Server machine>, I get the error as specified in the above post. But, when I run the same script in Powershell ISE, I get the correct result.

However, When I put a Primary DC Server in the Script argument and test it for any other target Windows machine, it runs just fine.

I'm not sure where am I falling wrong. Need help to identify the same...

Thanks

Amrita

I'm running the script in the template on SAM Server having powershell v4.0. Whereas, the template suggests to use v2.0 . Is this something to be cared about ?

The version of PowerShell used should be irrelevant, provided it's 2.0 or greater which is required for WinRM support. The issue you describe sounds like your NTP server is timing out on occasion. Have you tried replacing it with pool.ntp.org?

Hi aLTeReGo​,

Tried replacing the ntp server argument with "pool.ntp.org", but no luck !

What could be the issue when the script could be executed fine in Powershell ISE but not in the template.

Many Thanks !!!

Typically, that would be a WinRM issue, but the error you shared above is complaining that the script is expecting an integer, but is being returned a string. This usually means the script returned an error. If your firewall is dropping NTP packets that would explain why you're unable to contact pool.ntp.org, but I still suspect that we're troubleshooting an issue getting time from the NTP server consistently. i've seen this occur when users attempt to use external NTP sources which ban/block or rate limit the number of incoming NTP requests from your external publicly facing IP address. This typically occurs for those who apply the template to lots of nodes, each one of them querying every 5min. I'm not going to lie, it's happened to me on more than one occasion too.

This could be a reason, but not in my case... I have implemented and tested this on just one of the servers.

Under what conditions this monitor template will go into the "DOWN" state ?

The critical, warning, healthy states are understandable, but what does the DOWN state mean here ?

Thanks!

The components in this template will return a 'Down' status if the script is unable to execute properly for whatever reason. E.G. the script throws an error when being executed. Below is an example of an error being returned by the script that would result in a 'Down' status.

The return code is different than expected. Testing on node '10.199.4.133' failed with 'Down' status ('Down' might be different if script exits with a different exit code).

Unable to Get-WmiObject Win32_UTCTime on remote client. Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Thanks a ton, aLTeReGo​ !

I've modified the original code to allow for running this default SolarWinds monitor against the SolarWinds server itself, or systems where the Agent has been installed.  This was previously not an option with the script provided out of the box...

[code]

$ntpServer = $args[0];

if ( !$ntpServer )

{

Write-Host "Message: Can't find ""ntpServer"" argument. Check documentation.";

exit 1;

}

$ntpQuery  =  Invoke-Expression "w32tm /monitor /computers:$ntpServer" | Out-String;

$findSkew = [regex]"(?:NTP\: )(?<Value>/?[^s]+)";

If (($ntpQuery -match $findSkew))

{

    $ntpToSolarSkew = $Matches['Value'];

    $Error.Clear();

    try

    {

        $params = @{

        'Class' =  'Win32_UTCTime'

        }

        if ($computer) {

        $params += @{'ComputerName' = $Computer}

        switch ($computer){

            "$env:COMPUTERNAME" {break}

            'localhost' {break}

            '.'   {break}

            default {$params += @{'Credential' = $CREDENTIAL}}

            }

        }

        $remoteServerTime = Get-WmiObject @params

    }

    catch

    {

        Write-Host "Message: Unable to Get-WmiObject Win32_UTCTime on remote client. $($Error[0])";

        exit 1;

    }

    $localTime = $(Get-Date).ToUniversalTime();

    $remoteToSolarSkew = New-TimeSpan $localTime $(Get-Date -year $remoteServerTime.Year -month $remoteServerTime.Month -day $remoteServerTime.Day -hour $remoteServerTime.Hour -minute $remoteServerTime.Minute -second $remoteServerTime.Second);

    If ($remoteToSolarSkew)

    {

        $Skew = $remoteToSolarSkew.TotalSeconds - $ntpToSolarSkew;

        $stat=[math]::round($Skew,2);

        $symb=$stat.ToString().Substring(0,1);

        if ($symb -eq "-")

        {

            $tmp=$stat.ToString().Remove(0,1);

            Write-Host "Message: Clock drift: $stat.";

            Write-Host "Statistic: $tmp";

            exit 0;

        }

        else

        {

            $stat=[math]::round($Skew,2);

            Write-Host "Message: Clock drift: $stat s.";

            Write-Host "Statistic: $stat";

            exit 0;

        }

    }

    Else

    {

        Write-Host "Message: Unable to Get-WmiObject Win32_UTCTime";

        exit 1;

    }

}

Else

{

    Write-Host "Message: Unable to query NTP server $ntpServer.";

    exit 1;

}

[/code]

hi cczech  ,

     I think it works for me.

Initially, I was getting an error for few nodes so I added them to a new monitor to observe the results if the monitor is showing the same error for those nodes.

But as of now they are in green State. I am putting them under observation for 24 hours.

Thank you so much!!

Regards

Rahul Bajpai

If the clock drift is a small negative number, the SAM Server Clock Drift (PowerShell) template returns an invalid result, the application monitor shows an Unknown status, and the following message may appear: "Scripting Error: Script does not contain the expected parameters or is improperly formatted. 'Statistic' missing." This issue was fixed in SAM 6.4 but if you started with SAM 6.3 or earlier, note that most templates are not automatically updated during upgrades. If you receive this error, download the latest version of the template, as attached to this post. Click here​ for another workaround.

Note: SolarWinds recommends that you check THWACK periodically for updates to out-of-the-box (OOTB) templates included with SAM. With the exception of AppInsight templates, application monitor templates are not updated automatically during upgrades to avoid overwriting any custom changes that may have been made to templates.

Version history
Revision #:
1 of 1
Last update:
‎04-16-2012 05:33 PM