Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to write a small application which needs to detect if the system time is changed by an another application/user and perform some action as soon as it is detected (maybe log the data that time has changed, along with info about which application/user changed it).

How can this be achieved?

  1. I have good programming experiences in shell script, c and beginner level in python.
  2. I don't need to know when it was changed, just need to know who/what changed it.
  3. The system uses NTP to sync the time, but it is also possible for anyone/any application to change the time(for eg: using the simple "date" command as well).
share|improve this question
You might want to add: What are your experiences in programming? – slhck Jun 9 '11 at 12:11
If you're going to log the time that system time is changed, how will you say when it was changed? What's your reference? – pavium Jun 9 '11 at 12:12
Is the assumption this test will only be needed during the current boot and does the system not have a time server? – zedman9991 Jun 9 '11 at 12:14
I have updated the description with the information requested – Vicky Jun 9 '11 at 12:24

I think this article has an answer to your question: Notify userspace about time changes. But please note that the patch mentioned in the article is quite recent, so you have to check your linux kenel vesrion first.

If your kernel does not support userspace notification mechanism, then you can implement the following algorithm (in pseudocode):

time = gettimeofday()

    sleep 1 second
    new_time = gettimeofday()
    if (time_diff(new_time, time) > 2 seconds) then
       alert System time has changed by an external user/process!

    time = new_time
    goto loop

Hope this helps.

share|improve this answer

System Call Tracker do the same thing you want. You can use/modify that code.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.