• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Log Entries with Date in the Future

Scheduled Pinned Locked Moved Virtualization
14 Posts 2 Posters 1.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • I
    IsaacFL
    last edited by Jan 30, 2020, 10:33 PM

    I have seen instances where the time on the logs is not the time on the system.

    Maybe it is due to Hyper-V? I am using Hyper-V 2019 Core.

    I have attached a picture, see the Firewall Logs, then look at the current time, and you see the Logs have a date that is in the future. When I first noticed it, it was about 10 minutes ahead.

    I upgraded today to the 2.4.5-RC but I have seen it before on 2.4.4.

    Annotation 2020-01-30 122111.png

    Has anybody else seen this?

    P 1 Reply Last reply Jan 30, 2020, 11:53 PM Reply Quote 0
    • P
      provels @IsaacFL
      last edited by Jan 30, 2020, 11:53 PM

      @IsaacFL There are many instances of "time drift" documented in Hyper-V. Try disabling time sync in Integration Services. Let NTP continue to set pfSense's time. https://www.bing.com/search?q=hyper-v+time+drift

      9e27ec48-2ed4-4002-b509-1d3c4842110c-image.png

      Peder

      MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
      BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

      I 1 Reply Last reply Jan 31, 2020, 12:47 AM Reply Quote 0
      • I
        IsaacFL @provels
        last edited by Jan 31, 2020, 12:47 AM

        @provels said in Log Entries with Date in the Future:

        @IsaacFL There are many instances of "time drift" documented in Hyper-V. Try disabling time sync in Integration Services. Let NTP continue to set pfSense's time. https://www.bing.com/search?q=hyper-v+time+drift

        9e27ec48-2ed4-4002-b509-1d3c4842110c-image.png

        I had already done that.

        P 1 Reply Last reply Jan 31, 2020, 12:58 AM Reply Quote 0
        • P
          provels @IsaacFL
          last edited by provels Jan 31, 2020, 1:31 AM Jan 31, 2020, 12:58 AM

          @IsaacFL What else have you tried? Bounce NTP? Do the times ever sync, then drift?

          Peder

          MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
          BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

          I 1 Reply Last reply Jan 31, 2020, 2:46 AM Reply Quote 0
          • I
            IsaacFL @provels
            last edited by Jan 31, 2020, 2:46 AM

            @provels what I have been trying was fooling with the NTP service. I tried different pools, settings, etc.

            It seems to be fine most of the time, but then I will notice it, and usually I just restart NTP service and it is ok.

            It is something that unless you are looking for it, since you kind of just accept the dates and times in the logs.

            I only started watching for it, when I saw some NTP entries in the log about clock not synchronized.

            kernel reports TIME_ERROR: 0x41: Clock Unsynchronized

            P 1 Reply Last reply Jan 31, 2020, 10:28 AM Reply Quote 0
            • P
              provels @IsaacFL
              last edited by provels Jan 31, 2020, 10:41 AM Jan 31, 2020, 10:28 AM

              @IsaacFL Do either of the times match the host time? Does the host use the same time NTP source? FWIW, I also see the same error in the NTP logs at various intervals, as well as plenty of "Unexpected origin timestamp xxxxx.xxxxx does not match aorg 00000.00000 from xx" messages.

              Peder

              MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
              BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

              I 1 Reply Last reply Jan 31, 2020, 7:40 PM Reply Quote 0
              • I
                IsaacFL @provels
                last edited by Jan 31, 2020, 7:40 PM

                @provels The host was using time.windows.com as the ntp source. The time seems to be correct. I changed the host ntp to 2.us.pool.ntp.org so it could also use ipv6.

                I haven't been able to find a pattern, so just trying to change random things.

                P 1 Reply Last reply Jan 31, 2020, 8:17 PM Reply Quote 0
                • P
                  provels @IsaacFL
                  last edited by provels Jan 31, 2020, 8:54 PM Jan 31, 2020, 8:17 PM

                  @IsaacFL I see on mine that the Windows Time Service only checks once a week. That can be changed in Registry.
                  Does the log time seems to match the host time when it gets out of whack? Might be something to monitor. Maybe just a Hyper-V "thing". From what I've read, probably better to keep Time Sync turned on in Integration Services.
                  6a33ef24-80f6-4fe4-8061-b693df867095-image.png

                  Peder

                  MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                  BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                  I 1 Reply Last reply Jan 31, 2020, 10:21 PM Reply Quote 0
                  • I
                    IsaacFL @provels
                    last edited by Jan 31, 2020, 10:21 PM

                    @provels I just checked and my Windows Time Service is much more often.

                    Currently it is saying that the last sync at 2:12 and next sync at 2:29.

                    I am using Hyper-V Server 2019 Core (no gui)

                    It seems to be stable now, so not sure what else to look at.

                    You said you have read that it is better to keep Time Sync "on" in integration services?

                    I have read the opposite, but never a good reason either way. Mine are currently off.

                    I 1 Reply Last reply Jan 31, 2020, 10:38 PM Reply Quote 0
                    • I
                      IsaacFL @IsaacFL
                      last edited by Jan 31, 2020, 10:38 PM

                      I have turned "on" Time Sync in Integration Services and rebooted the router. So far everything looks good.

                      P 2 Replies Last reply Feb 1, 2020, 10:22 AM Reply Quote 0
                      • P
                        provels @IsaacFL
                        last edited by provels Feb 1, 2020, 10:23 AM Feb 1, 2020, 10:22 AM

                        @IsaacFL Is this a domain or just a workgroup? I could see a problem if you have a domain and your DC is a time server as well. That could start a loop between the host and the DC if VMs are looking at the DC and the host is controlling the VMs. But that shouldn't affect pfSense and what you saw. Seems like the logs are using a different time source and I suspect it could be the host.
                        PS - I also changed my host (2012R2) to update hourly.

                        Peder

                        MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                        BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                        1 Reply Last reply Reply Quote 0
                        • P
                          provels @IsaacFL
                          last edited by Feb 1, 2020, 1:03 PM

                          @IsaacFL This is interesting. After restarting NTP a couple of hours ago, and Time Sync off on the VM, I see this:
                          199e4fd8-012b-4920-b1b6-2700f5f5dc0d-image.png

                          Peder

                          MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                          BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                          I 2 Replies Last reply Feb 1, 2020, 5:56 PM Reply Quote 0
                          • I
                            IsaacFL @provels
                            last edited by Feb 1, 2020, 5:56 PM

                            @provels it is a single workgroup host with pfSense and 2 Linux VMs.

                            1 Reply Last reply Reply Quote 0
                            • I
                              IsaacFL @provels
                              last edited by Feb 5, 2020, 7:01 PM

                              @provels

                              I think that the setting to have the Time Synchronization enabled in Integration Services fixes this.

                              Since I enabled this setting, I have only seen the clock unsynchronized error at reboot.

                              1 Reply Last reply Reply Quote 1
                              14 out of 14
                              • First post
                                14/14
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                This community forum collects and processes your personal information.
                                consent.not_received