Ticket #3280 (closed defect: fixed)

Opened 6 years ago

Last modified 5 years ago

XP guest security log gets filled with time change messages

Reported by: vbox4me2 Owned by:
Priority: minor Component: guest additions
Version: VirtualBox 2.0.6 Keywords: time update every minute
Cc: Guest type: Windows
Host type: Windows


The log is updated every minute with:

Event Type:	Success Audit
Event Source:	Security
Event Category:	System Event 
Event ID:	520
Date:		5-2-2009
Time:		18:55:23
Computer:	NAME
The system time was changed.
 Process ID:	4
 Process Name:	
 Primary User Name:	NAME$
 Primary Domain:	TSGROUP01
 Primary Logon ID:	(0x0,0x3E7)
 Client User Name:	-
 Client Domain:	-
 Client Logon ID:	-
 Previous Time:	6:55:23 PM 2/5/2009
 New Time:	6:55:23 PM 2/5/2009

For more information, see Help and Support Center at

w32time service is NOT running on guest(only on host), guest additions installed and running.

Host: XP64 SP2 (fully updated) Guest: XP SP3 (fully updated)

Obviously the security log is getting flooded every day...

Change History

comment:1 Changed 6 years ago by vbox4me2

Just repeated this with Vista as host, same thing.

comment:2 Changed 6 years ago by TerryE

The algo used in WINNT is different to that used in Linux. It is implemented in routine vboxWorkerThread in src/VBox/Additions/WINNT/VBoxGuest/VBoxGuest.cpp. The code always seems to invoke ZwSetSystemTime whether or not it needs to. Given that this then floods the security log, I would class this as a bug.

I am not sure what the WinNT tick is but given this I would expect there to be some small jitter in clock comparison and your adjustment algo should not fight this (in a control system sense). I would suggest that you low pass filter the delta (a simple 1 pole IIR would do here, plus some hysteresis so that the adjustment is a one-shot if greater than say 10ms as shown in the following pseudo-code. (Note that I've used an integer version, assuming that we are working in msec):

  calculatedDeltaTime = ...
  lowPassDeltaTime =  ( FILTER_CONST * lowPassDeltaTime + calculatedDeltaTime ) /
                      ( FILTER_CONST + 1)
  if ( lowPassDeltaTime >  LOW_PASS_TIME_THRESHOLD ||
       lowPassDeltaTime < -LOW_PASS_TIME_THRESHOLD) {
    // now make the adjustment and set lowPassDeltaTime = 0

This will eliminate nugatory time change audit records. A filter constant of about 4 should do.

comment:3 Changed 6 years ago by vbox4me2

Or simply add a cmd param to disable ZwSetSystemTime completely. For now I've hacked the function from working since I need to be able to run a vm at a different point in time.

comment:4 Changed 5 years ago by frank

  • Status changed from new to closed
  • Resolution set to fixed

I assume this bug is obsolete as the time synchronization was completely rewritten and the time is only adjusted if there is a difference.

Note: See TracTickets for help on using tickets.
ContactPrivacy policyTerms of Use