3

I need to write a small application which needs to detect if the system time is changed by an another application/user and perform some action as soon as it is detected (maybe log the data that time has changed, along with info about which application/user changed it).

How can this be achieved?

  1. I have good programming experiences in shell script, c and beginner level in python.
  2. I don't need to know when it was changed, just need to know who/what changed it.
  3. The system uses NTP to sync the time, but it is also possible for anyone/any application to change the time(for eg: using the simple "date" command as well).
4
  • You might want to add: What are your experiences in programming?
    – slhck
    Jun 9, 2011 at 12:11
  • If you're going to log the time that system time is changed, how will you say when it was changed? What's your reference?
    – pavium
    Jun 9, 2011 at 12:12
  • Is the assumption this test will only be needed during the current boot and does the system not have a time server?
    – zedman9991
    Jun 9, 2011 at 12:14
  • 1
    I have updated the description with the information requested
    – Vicky
    Jun 9, 2011 at 12:24

3 Answers 3

4

I think this article has an answer to your question: Notify userspace about time changes. But please note that the patch mentioned in the article is quite recent, so you have to check your linux kenel vesrion first.

If your kernel does not support userspace notification mechanism, then you can implement the following algorithm (in pseudocode):

time = gettimeofday()

loop:
    sleep 1 second
    new_time = gettimeofday()
    if (time_diff(new_time, time) > 2 seconds) then
       alert System time has changed by an external user/process!

    time = new_time
    goto loop

Hope this helps.

1
  • Note: time_diff should do abs() so there are no negative values. Jul 6, 2020 at 19:55
0

You want to use timerfd_settime() with TFD_TIMER_CANCEL_ON_SET (timerfd_settime(2)):

  TFD_TIMER_CANCEL_ON_SET
              If this flag is specified along with TFD_TIMER_ABSTIME and the
              clock for this timer is CLOCK_REALTIME or CLOCK_REAL‐
              TIME_ALARM, then mark this timer as cancelable if the real-
              time clock undergoes a discontinuous change (settimeofday(2),
              clock_settime(2), or similar).  When such changes occur, a
              current or future read(2) from the file descriptor will fail
              with the error ECANCELED.
-1

System Call Tracker do the same thing you want. You can use/modify that code.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .