Server Time Monitor

The Server Time Monitor checks the clock accuracy of a monitored Windows server by comparing its current time to a reference time source. If the time difference exceeds a configurable threshold, the monitor fires actions.

Incorrect server time can cause a wide range of problems including Kerberos authentication failures, inaccurate log timestamps that make correlation difficult, backup schedule issues and certificate validation errors. This monitor helps you detect clock drift before it causes these problems.

Time Threshold

The threshold defines the maximum acceptable time difference between the target server and the reference source. You can specify the threshold in seconds, minutes, or hours. The default threshold is 30 seconds. If the server's clock differs from the reference by more than this amount, the monitor will fire actions.

Reference Time Sources

The monitor supports three reference source modes:

• Auto (NTP with Central Server fallback) — The monitor first tries to query the configured NTP server. If the NTP query fails (due to network restrictions, firewall rules, etc.), it automatically falls back to using the Central Service's time as the reference. This is the default and recommended setting.
• NTP only — The monitor only uses the configured NTP server. If the NTP server cannot be reached, the monitor will report an error rather than falling back.
• Central Server only — The monitor uses the Central Service's time as the reference. This is useful in environments where NTP servers are not accessible, such as air-gapped or disconnected networks. When this option is selected, the NTP server address field is disabled.

NTP Server Address

The NTP server used when the reference source is set to Auto or NTP only. The default is pool.ntp.org which is a widely available public NTP pool. You can change this to an internal NTP server if your environment requires it.

Test Button

The Test Now button performs an immediate time comparison using the current settings and displays the result in the dialog. This is useful for verifying that the NTP server is reachable and for seeing the current offset before saving the monitor configuration.

How It Works

When the monitor runs, it:

1. Queries the reference time source (NTP server or Central Service) to get the current reference UTC time.
2. Queries the target server's current UTC time. For remote servers, this uses the Windows NetRemoteTOD API. For the local server, it reads the system clock directly.
3. Calculates the difference in seconds between the two times.
4. Compares the difference to the configured threshold and reports the result.

The default monitoring interval is once per hour since clock drift is typically a gradual process.

Scripting Variables

The following variables are available for use in action scripting and custom alert messages:

Standard Configuration Options

Like all monitors, this monitor has standard buttons on the right for Adding Actions, setting Advanced Options and setting the Monitor Schedule.