Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The time delta between node <server> and node <server> is <value>(in 100 nanosecs).
|English: Request a translation of the event description in plain English.|
This event message is informational only. It does not indicate a problem if the reported time delta is less than five minutes. Time-sensitive programs and the Kerberos protocol require accurate time to work correctly. The Windows Time service will correct the time during the next polling interval. See ME914025 for additional information about this issue.
Max A. Kostioukovitch
In my experience if you reboot one of cluster nodes, time discrepancy between them may occur while the re-sync with NTP source such as local Domain Controller has not yet happened. For reliable cluster operation, it is preferred to keep them synchronized.
This is why once the discrepancy appeared servers apparently start controlling their tick rate to reduce it. The following messages show the decreasing difference, which is eliminated at a decreasing rate (i.e. it starts to decrease quickly, let's say 9 seconds in a minute, then the adjustment rate slows to 8 seconds in 100 seconds, and so on...).
It is very easy to see the current amount of discrepancy in more measurable units - 100 ns is 10 to the minus 7-th power of a second. Therefore, to convert this "big number" mentioned in the event text to seconds, you just need to select the rightmost 7 digits with mouse. Then the non-selected part to the left will show the difference in seconds. Let us say "the big number" is 420291839, then by selecting out the right 7 digits you get 42 seconds.
These messages are informational and normally would subside quickly, as soon as the cluster nodes finish the time synchronization process.
|Private comment: Subscribers only. See example of private comment|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
|Custom search for *****: Google - Bing - Microsoft - Yahoo|
Send comments or solutions
- Notify me when updated