Hi All
Is it possible to track real-time time offset using only BigFix Analysis, without relying on actions such as tasks or fixlets, assuming the NTP source machine is also managed by BigFix?
Thanks.
do you mean track which time zone offset a user currently has based on location for those that travel between multiple time zones?
relevance with Local time zone will return a time zone corresponding to the machines local time zone and will report back as -0400 or whatever their time zone offset is. I believe that would update as frequently as you have the property set to re-evaluate the relevance as long as the time zone on the computer is also set to automatically update the time zone.
local time zone
Thank you, but I’m not looking for the time zone offset. I’m looking for the NTP offset value, similar to the value reported by the w32tm command in Windows, for example.
I'm pretty sure that offset that is used by w32tm /monitor is computing the time offset between the domain controllers time that it's referencing and the local system's clock. I don't think that anything is going to have that exact offset where relevance would be able to query it without an actual command being issued from some sort of action being issued. I feel like if this is the offset you are trying to get it would require an action to run periodically that runs the query and writes it to a log files and your property in your analysis pulls the data from that log file.
I originally was going to say that you might be able to turn on Debug logging for the w32time service and write that to a log file then have bigfix read from that log file because the time offsets will write to that debug log file but then once I tested it I realized that w32time locks that debug log file constantly so BigFix will never be able to actually read it while the w32time service is running so I don't think that will work.
There is the locked line of <file> inspector that might help read the debug log? https://developer.bigfix.com/relevance/reference/file.html#locked-line-of-file-file-line
You could also issue the command and output the data to a text file or register key.
Using a batch for loop, you could cut out all of the other data.
Thanks Aram, that does work. I always forget about that inspector.
@S2S With the disclaimer that you should definately test this in a controlled environment before you use it because i'm not sure what the ramifications are of having debug logs running all of the time for the w32time service. Generally speaking, Debug logs for anything are not recommended to be running all of the time but if you are trying to troubleshoot or monitor something specific this might actually work for you rather than having an action re-running all of the time.
Create this task with an action to do the following command
waithidden w32tm /debug /enable /file:C:\windows\temp\w32time.log /size:10000000 /entries:0-300
waithidden cmd.exe /c net stop w32time
waithidden cmd.exe /c net start w32time
To disable debug logging you can run this
waithidden w32tm /debug /enable
you can then use relevance to query the log using something like this
locked lines whose (it contains "offset" ) of file "c:\windows\temp\w32time.log" of encoding "UTF-16LE"
Thanks everyone for the help. That answers my question. It sounds like BigFix Analysis by itself cannot track real-time time offset, even if the NTP source is also managed by BigFix. If I need the actual offset, I’ll need to collect it first with an action/script/logging method and then report it through Analysis. Appreciate all the guidance.
When reading data, the two methods in BigFix are either
- A native inspector for the actual API / datastore, etc.
- A method to extract data using inspectors that do exist.
Since there isn't an inspector for the NTP protocol, we reach for log files on the file system, slurped up by an analysis.
Although I am curious... why is the NTP offset something of interest? Astronomers are known to be highly curious about it, most others don't care about time slew to that degree of detail. (I once knew an NTP admin who campaigned constantly for a GPS reader that would let him get truly local positioning, and therefore time.)