Knowing when a server machine's clock gets reset
 

Is there anyway to know when a server machine's clock is reset? Or is there anyway to know when the clock was last reset?

For example: if you use VMwares ability to sync the time of the server machines running on a specific server system is there anyway of knowning when VMware does reset the clock of any of those machines or when the last time the clock of a machine was reset?

Jim4522

NTP logs any changes it makes to the clock and there's specific system calls for time-related stuff so AFAIK an audit rule could fire too when it's tripped?

UnSpawn,

Do you know if the time sync in VMware tools logs when it makes changes to a clock as you indicate NTP does?

Jim4522

No I don't. But that's something you could test yourself: just skew the guests clock and see if VMware tools time sync picks it up. Logs to check should be the guests OS syslog, the virtualization client logs and just to make sure the VMware server logs. Please post back the results, reciprocity and all that.

unSpawn,

I will have the test run that you suggest and post the results but so I am sure I understand one of the terms you use (I am a manager not a tect type) when you suggest checking the guest's OS Syslog I assume this is the syslog of the machine whose clock was changed. What will I have my people look for? Are they looking for an indicator that the clock was changed and the date and time of the change? Jim4522

Hmmm, on second thought please be aware: "VMware recommends you to use NTP instead of VMware Tools periodic time synchronization. NTP is an industry standard and ensures accurate time keeping in your guest." See http://kb.vmware.com/selfservice/mic...rnalId=1006427 and http://kb.vmware.com/selfservice/mic...xternalId=1318

UnSpawn,

Thanks for that suggestion I will pass it own to my tech people. Two final related questions to end this thread.

If using NTP or VMware tools to sync the clock causes an indication to be logged in the guest OS Syslog do you know if changing the clock manually also causees an indication to be set in that OS Syslog?

What is the easiest way to check the OS Syslog to see if a clock change has occurred on a specific guest?

Jim4522