XP guest security log gets filled with time change messages

[vbox4me2]

The log is updated every minute with:

Event Type:	Success Audit
Event Source:	Security
Event Category:	System Event 
Event ID:	520
Date:		5-2-2009
Time:		18:55:23
User:		NT AUTHORITY\SYSTEM
Computer:	NAME
Description:
The system time was changed.
 Process ID:	4
 Process Name:	
 Primary User Name:	NAME$
 Primary Domain:	TSGROUP01
 Primary Logon ID:	(0x0,0x3E7)
 Client User Name:	-
 Client Domain:	-
 Client Logon ID:	-
 Previous Time:	6:55:23 PM 2/5/2009
 New Time:	6:55:23 PM 2/5/2009


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

w32time service is NOT running on guest(only on host), guest additions installed and running.

Host: XP64 SP2 (fully updated) Guest: XP SP3 (fully updated)

Obviously the security log is getting flooded every day...

[vbox4me2]

Just repeated this with Vista as host, same thing.

[Terry Ellison]

The algo used in WINNT is different to that used in Linux. It is implemented in routine vboxWorkerThread in src/VBox/Additions/WINNT/VBoxGuest/VBoxGuest.cpp. The code always seems to invoke ZwSetSystemTime whether or not it needs to. Given that this then floods the security log, I would class this as a bug.

I am not sure what the WinNT tick is but given this I would expect there to be some small jitter in clock comparison and your adjustment algo should not fight this (in a control system sense). I would suggest that you low pass filter the delta (a simple 1 pole IIR would do here, plus some hysteresis so that the adjustment is a one-shot if greater than say 10ms as shown in the following pseudo-code. (Note that I've used an integer version, assuming that we are working in msec):

  calculatedDeltaTime = ...
  lowPassDeltaTime =  ( FILTER_CONST * lowPassDeltaTime + calculatedDeltaTime ) /
                      ( FILTER_CONST + 1)
  if ( lowPassDeltaTime >  LOW_PASS_TIME_THRESHOLD ||
       lowPassDeltaTime < -LOW_PASS_TIME_THRESHOLD) {
    // now make the adjustment and set lowPassDeltaTime = 0
    ...
  }

This will eliminate nugatory time change audit records. A filter constant of about 4 should do.

[vbox4me2]

Or simply add a cmd param to disable ZwSetSystemTime completely. For now I've hacked the function from working since I need to be able to run a vm at a different point in time.

[Frank Mehnert]

I assume this bug is obsolete as the time synchronization was completely rewritten and the time is only adjusted if there is a difference.