I need to write a small application which needs to detect if the system time is changed by an another application/user and perform some action as soon as it is detected (maybe log the data that time has changed, along with info about which application/user changed it).

How can this be achieved?

  1. I have good programming experiences in shell script, c and beginner level in python.
  2. I don't need to know when it was changed, just need to know who/what changed it.
  3. The system uses NTP to sync the time, but it is also possible for anyone/any application to change the time(for eg: using the simple "date" command as well).
  • You might want to add: What are your experiences in programming? – slhck Jun 9 '11 at 12:11
  • If you're going to log the time that system time is changed, how will you say when it was changed? What's your reference? – pavium Jun 9 '11 at 12:12
  • Is the assumption this test will only be needed during the current boot and does the system not have a time server? – zedman9991 Jun 9 '11 at 12:14
  • 1
    I have updated the description with the information requested – Vicky Jun 9 '11 at 12:24

I think this article has an answer to your question: Notify userspace about time changes. But please note that the patch mentioned in the article is quite recent, so you have to check your linux kenel vesrion first.

If your kernel does not support userspace notification mechanism, then you can implement the following algorithm (in pseudocode):

time = gettimeofday()

    sleep 1 second
    new_time = gettimeofday()
    if (time_diff(new_time, time) > 2 seconds) then
       alert System time has changed by an external user/process!

    time = new_time
    goto loop

Hope this helps.

| improve this answer | |
  • Note: time_diff should do abs() so there are no negative values. – lapkritinis Jul 6 at 19:55

System Call Tracker do the same thing you want. You can use/modify that code.

| improve this answer | |

You want to use timerfd_settime() with TFD_TIMER_CANCEL_ON_SET (timerfd_settime(2)):

              If this flag is specified along with TFD_TIMER_ABSTIME and the
              clock for this timer is CLOCK_REALTIME or CLOCK_REAL‐
              TIME_ALARM, then mark this timer as cancelable if the real-
              time clock undergoes a discontinuous change (settimeofday(2),
              clock_settime(2), or similar).  When such changes occur, a
              current or future read(2) from the file descriptor will fail
              with the error ECANCELED.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.