Problem with time sync execution

[vootz]

Hi,

I wanna calculate a time difference between real time and time on a server.

In order to do that i've created 2 items:
- system.run[/opt/stack/bin/get-time.sh] this one's gets time
- last(system.localtime)-last(system.run[/opt/stack/bin/get-time.sh]) this one calculates the difference

I want triggers to inform me if the time difference is between 5 min and hour, and second one - greater than 1h.

Trigger to it looks like this:
- 5 min to 1h:
{my_linux_t:time.sync.abschange(0)}>300 & {my_linux_t:time.sync.abschange(0)}<3600

and the other one:
{my_linux_t:time.sync.abschange(0)}>3600

Now,

Triggers go off, but the one which should go off if the diference is greater than 3600 seconds goes off at really small values (58,57, 56, 55 .....)
The other one react the opposite way: goes off after values are greater than 3500 (!) seconds.

Where did i go wrong ?
Help anyone?

Best Regards

[kevind]

I don't think it will work to use a calculated item the way that you're trying to do it. The 2 time items you're collecting are collected at different times on a schedule set by zabbix which will be different for each host. The calculated item is calculated on yet another schedule independent of the other items. Depending on when each item updates, your results can be very different.

We check for tiime sync as follows:

1) create an item "Host local time" of type "Zabbix agent" (NOT "Zabbix Agent (Active)"), Key of "system.localtime", "Numeric (unsigned)" "decimal", units "unixtime". We use an update interval of 300 sec (we care a lot about clock sync).

2) create a trigger named "{HOST.NAME}: Time Drift > 30 Sec" with expression "{system.localtime.fuzzytime(30)} =0"

Now, a Zabbix poller thread will ask the agent its local time, wait for the answer, and put the data in a queue. Another thread will quickly take the data from the queue and check to see if the time difference from the Zabbix server is more than 30 seconds. An alert will be issued if it is.

The only thing that can go wrong here is if there is a long delay between collecting the time from the host and checking it against the server time. In normal operation it should be very short, but it isn't 0,which is why you can't use this technique to check for a 1-second drift.

When we first started doing this we got occasional time drift alerts that I thought were false alerts due to delays in processing in Zabbix. Turns out the alerts weren't false, we really had clock drift problems. Getting clocks configured to stay in sync can be surprisingly difficult.

-Kevin

[NE1Scott]

Is there any update for this procedure now on Zabbix 5.0 and newer ? i don't see a way to add an item that can be used for all hosts and adding it 1 at a time is not feasible.
I assume this will only work with machines running a proper Zabbix agent and not ICMP ?
Does it also work for Windows Agents ?