Windowsxp time log

Thanks for your feedback. Hey Sorry if this is in the wrong forum My computer is pretty new got it in October and it's a pretty decent computer so it shouldn't have any problems. Any help would be great. Thanks :. This thread is locked. You can follow the question or vote as helpful, but you cannot reply to this thread. I have the same question Report abuse.

Details required :. Cancel Submit. If, and that's a big if, Privilege Use logging is enabled, event indicates a system time change. By default Windows event logging is anemic at best and Privilege Use logging is not enabled by default. The screen shots below show what happens. If you have auditing enabled for system events, you'll get an entry for event Hint: If these images aren't clear in your browser, click on the picture and it will launch in its own window for more clarity!

If that isn't good enough, right click on an image, save it locally, and then look at it, zoom into it, etc. The screen at the left shows privilege use logging enabled. Don't expect to see this in a default configuration. The screen at the left shows the resultant event log entries and in pairs when manually changing the system time. The screen at the left shows the resultant event log entries and when the Atomic Time Clock restores the time to the correct setting after it was manually changed.

Event ID in Windows event viewer shows, under the description, that the system time was changed and by which user. Other events listed later in this document provide this functionality. System Tick Count This event should happen rarely on systems with reasonable time synchronization, and we want to log it each time it occurs. We ignore TimeJumpAuditOffset setting while logging this event since that setting was meant to throttle events in the Windows System event log.

Event description System clock frequency adjusted Details System clock frequency is constantly modified by W32time when the clock is in close synchronization. We want to capture "reasonably significant" adjustments made to the clock frequency without overrunning the event log. On a synchronized system, most of the adjustments are below this level. If you want finer tracking, this setting can be adjusted down or you can use PerfCounters, or you can do both. Event description Change in the Time service settings or list of loaded time providers.

Details Re-reading W32time settings can cause certain critical settings to be modified in-memory, which can affect the overall accuracy of the time synchronization. W32time logs each occurrence when rereading its settings, which gives the potential impact on time synchronization. Throttling mechanism None. This event occurs only when an admin or GP update changes the time providers and then triggers W32time.

We want to record each instance of change of settings. Event description Time service source or stratum number changes Details W32time Time Source and Stratum Number are important factors in time traceability and any changes to them must be logged.

If W32time has no source of time and you haven't configured as a reliable time source, then it will stop advertising as a time server, and by-design respond to requests with some invalid parameters. This event is critical to track the state changes in an NTP topology. Throttling mechanism Max frequency - once every 5 minutes. It's possible that a bad network card or a poor script can trigger this operation repeatedly and result in logs getting overwhelmed.

Hence the need to throttle this event.