windows 2016 steps into future for half hour at 23:00 CET and then returns to normal

Question

windows 2016 steps into future for half hour at 23:00 CET and then returns to normal

Galien, Dirk 21

I have asp.net core 3.1 program with a very basic async socket receiver and a blazor webassembly frontend. Every half an hour a machine sends a report (+/- 1000 bytes) to it, which is then stored to sqlserver and to a file on disk.
Al thru the day this works fine except for at around 23:00 CET then the report is received as normal but the file time is around 23:30 so half an hour into the future! Also the recorded in the database is equally half an hour into the future.

The file is written with File.WriteAllText(xfilepath, xcontent); In the frontend i can see the report beeing added to the database also half an hour into the future.

This whole program runs as a hosted server on windows 2016 virtual machine region Netherlands timezone UTC+1 Amsterdam, Berlin...

Also posted with code on stackoverflow: datetime-now-on-windows-2016-skips-30-minutes-into-future

Anybody any idea what is going on here??

Jenny Yan-MSFT 9,216 Reputation points

2020-11-20T07:41:33.913+00:00

May I know if the two machines are set with the same time zone? How about manually modifying the timezone from UTC+1 to UTC in the VM?

Thanks,
Jenny
Galien, Dirk 21 Reputation points

2020-11-21T09:41:51.203+00:00

Jenny,

The machine is hosted in vmware where i have no direct administrative access to. I will ask my colleague first thing on Monday to check the virtual machine setup.

Then the machine sending the report is just a industrial machine with now awareness of timezone. It just send a small text report as barebones TCP client every half an hour.

Thank you,
Dirk
Jenny Yan-MSFT 9,216 Reputation points

2020-11-24T01:42:21.53+00:00

Hi Dirk,
Kindly take your time and update next time after confirming with your colleague.

Have a nice day.

Best Regards,
Jenny
Dirk van der Galien 1 Reputation point

2020-11-30T07:44:14.59+00:00

Jenny,

Our network specialist says there is nothing different in the setup of this vm to ten or so other vm's, thee are all based on the same image. So for now i am ruling that out.

I did find this in the System log:

Hoe can i find wat service does this?
And a little later this:

Does that help in any way?

Thanks for your help so far,
Dirk
Dirk van der Galien 1 Reputation point

2020-11-30T07:48:06.49+00:00

Jenny,

This is what happens in the system log:

And somewhat later this:
Dirk van der Galien 1 Reputation point

2020-11-30T07:52:38.263+00:00

first thing happening in the system log
Galien, Dirk 21 Reputation points

2020-11-30T07:56:13.9+00:00

This is what happens in the system log:

And somewhat later this:
Galien, Dirk 21 Reputation points

2020-11-30T08:17:24.56+00:00

Jenny,

Sorry for the double image uploads.

It is a petty the Kernel General event does not say wat service it is changing the time. How can i find that?

Thanks,
Dirk

Jenny Yan-MSFT 9,216 Reputation points

2020-11-20T07:41:33.913+00:00

May I know if the two machines are set with the same time zone? How about manually modifying the timezone from UTC+1 to UTC in the VM?

Thanks,
Jenny
Galien, Dirk 21 Reputation points

2020-11-21T09:41:51.203+00:00

Jenny,

The machine is hosted in vmware where i have no direct administrative access to. I will ask my colleague first thing on Monday to check the virtual machine setup.

Then the machine sending the report is just a industrial machine with now awareness of timezone. It just send a small text report as barebones TCP client every half an hour.

Thank you,
Dirk
Jenny Yan-MSFT 9,216 Reputation points

2020-11-24T01:42:21.53+00:00

Hi Dirk,
Kindly take your time and update next time after confirming with your colleague.

Have a nice day.

Best Regards,
Jenny
Dirk van der Galien 1 Reputation point

2020-11-30T07:44:14.59+00:00

Jenny,

Our network specialist says there is nothing different in the setup of this vm to ten or so other vm's, thee are all based on the same image. So for now i am ruling that out.

I did find this in the System log:

Hoe can i find wat service does this?
And a little later this:

Does that help in any way?

Thanks for your help so far,
Dirk
Dirk van der Galien 1 Reputation point

2020-11-30T07:48:06.49+00:00

Jenny,

This is what happens in the system log:

And somewhat later this:
Dirk van der Galien 1 Reputation point

2020-11-30T07:52:38.263+00:00

first thing happening in the system log
Galien, Dirk 21 Reputation points

2020-11-30T07:56:13.9+00:00

This is what happens in the system log:

And somewhat later this:
Galien, Dirk 21 Reputation points

2020-11-30T08:17:24.56+00:00

Jenny,

Sorry for the double image uploads.

It is a petty the Kernel General event does not say wat service it is changing the time. How can i find that?

Thanks,
Dirk

Answer 1

Hi Dirk,
Thanks for the screenshots and the Kernel-General event ID 1 indeed proved that the time has been changed on the machine.

Did you know which source is used for the machine to sync time? Kindly check by following command. We used to encounter scenarios when two time sources used and issue occurred for another one.

w32tm /query [/computer:<target>] {/source | /configuration
https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/windows-time-service-tools-and-settings

Moreover, kindly search event ID 4616, which supposed to record info when system time changes and specify which process triggerred such change.
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4616
Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.
Hope above info would be bit helpful.

If above steps still fail to capture the process or service to change time, it is suggested to use process monitor tool and verify changes around the issue occurrence.
https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

Last suggestion is to re-register the windows time service:

----------

Hope this helps and please help to accept as Answer if the response is useful.

Thanks,
Jenny

Galien, Dirk 21 Reputation points

2020-12-01T06:46:25.063+00:00

It is caused by C:\Program Files\VMware\VMware Tools\vmtoolsd.exe

Lots of it on google. We still have to solve the problem but at least we know the cause now.

Thanks a lot,
Dirk
Jenny Yan-MSFT 9,216 Reputation points

2020-12-01T07:03:51.523+00:00

You are welcome and glad to be of help.

Have a nice day.

Best regards,
Jenny

windows 2016 steps into future for half hour at 23:00 CET and then returns to normal

0 additional answers

Activity