Configuring the Time Service: Enabling the Debug Log

  • Article

The debug log is a powerful tool in the W32Time bag of tricks when you need to figure out why something isn't working. The debug log tell you (for better or worse) what the Time Service is doing under the hood. Where it is connecting to, how long it is waiting between polls, etc.

In Windows Vista/Server 2008, we added the /debug option to the w32tm.exe command. This is the quickest and easiest way to configure the time service, and should be used if possible. A secondary option (if you are running XP/W2k3) is to edit the settings in the registry. Both will have the same effect, but using the w32tm command will keep you from having to get your hands dirty with registry editing. We will take a look at the w32tm command first:

Using the w32tm.exe command

To enable the w32time debug logging:

w32tm /debug /enable /file:C:\windows\temp\w32time.log /size:10000000 /entries:0-300

The command uses the following options:

  • /debug - This tells w32tm that you will be changing the debug log settings
  • /enable - We are turning on the debug log (as opposed to turning it off)
  • /file - Here we are specifying the full path of where the log file will be created; in this case: "C:\windows\temp\w32time.log"
  • /size: The maximum size of the log file, in bytes; in this case, it is 10 Mb. When the log is full, the w32time service will wrap to the top of the log file
  • /entries: This field is a mask, where you can mask off certain types of entries. More about this later.

Turning off the debug log is just as easy:

w32tm /debug /disable

Using the registry

In essence, the w32tm.exe command shown above does exactly what we are about to do here. The only real difference is that when you use w32tm, it handles the reloading of the config, which will actually apply the values found in the registry. Since we will now be making the changes ourselves, we will need to reload the config ourselves.

Note: If you just want a quick .reg file that you can modify and merge, skip to the bottom of this post. 

To get started, fire up the Windows registry editor:

Start -> Run -> Regedit.exe

Next, browse to the w32time config key, where we keep all of the w32time configuration:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config

Here, you will be creating the following three keys (if they do not exist):

  • FileLogName (REG_SZ)
  • FileLogSize (REG_DWORD)
  • FileLogEntries (REG_SZ)

Once they are created, go ahead and add the values that you want.

  • FileLogName should point to the full path where you want to store the log file. C:\windows\temp is the preferred location. Just ensure that a service running as LOCAL_SYSTEM has write access to the directory.
  • FileLogSize should be the maximum size of the log file, in bytes. Remember to convert to hex as needed 10Mb in hex would be 0x989680.
  • FileLogEntries is a numerical mask of the entries that you want to have logged in the log file. Each number in the range 1 - 300 represents a particular logging entry, such as polling intervals, packets received, etc. For the sake of simplicity, you should enable all logging. This is really only useful if you need to track a particular entry over a long period of time, and you don't want all of the other logging to clobber your file. Using 0-300 will guarantee that everything possible will be logged.

Once you apply the changes to the registry, you need to tell the w32time service that it needs to re-read the configuration information. To do this, you can use the following command:

w32tm /config /update

Example .reg file

Here is an example .reg file you can modify to simplify the process:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config]
"FileLogName"="C:\\windows\\temp\\w32time.log"
"FileLogEntries"="0-300"
"FileLogSize"=dword:00989680

As usual, If you have specific thoughts or questions about this post, please feel free to leave a comment. For general questions about w32time, especially if you have problems with your w32time setup, I encourage you to ask them on Directory Services section of the Microsoft Technet forums.

Comments

  • Anonymous
    February 28, 2008
    PingBack from http://www.biosensorab.org/2008/02/28/configuring-the-time-service-enabling-the-debug-log/

  • Anonymous
    June 03, 2008
    The comment has been removed

  • Anonymous
    June 03, 2008
    The debug log is designed to be an internal debugging tool, but we ship it in the product anyway. As you pointed out, some of the message numbers are documented but not an exhaustive list because it isn't built as a customer tool. If you need specific entries, you can either ask here or use "trial and error". Most of the calculations made by the service (that you are interested in) fall into a "discipline calculations" bucket, which is entry 62. Beyond that, you will need to parse the log to find a specific value.

  • Anonymous
    June 05, 2008
    Thanks Ryan! With FileLogEntries = 62, only "ClockDiscpln Update" lines are logged - for example: ClockDispln Update: SO:10326 KPhO:-392 PhO:10718 uT:3842 FllPPE:10718 PllPPE:10718 FllPPrE:192010 PllPPrE:190311 sysPollTicks:16383 FllDown:65533 PllUp:3842 PllDown:131064 FllRA:0 PllRA:0 RA:0 CR:156256 nT:1033 RAPhO:0 SD:299147 LI:0 S:2 RDl:312500 RDs:371744 TSF:0x0 Sync Is this as expected? Which of these many fields provides the clock offset - and what are the units? Also: These lines appeared before in the "full" log, but were prefixed (as was every log entry) with date and timestamp: 148809 19:16:49.3914379s - ClockDispln:ClockDispln Update: SO:-219272 KPhO:358 PhO:-219630 uT:3842 FllPPE:-219630 PllPPE:-215788 FllPPrE:242964 PllPPrE:241624 sysPollTicks:16383 FllDown:65533 PllUp:3842 PllDown:131064 FllRA:0 PllRA:0 RA:0 CR:156256 nT:8 RAPhO:0 SD:320512 (i) LI:0 S:2 RDl:312500 RDs:594206 TSF:0x0 Sync How do I get the date and time back? Are they controlled by a separate message number, and if so, what is it? I would also like to include the individual peer response / offset lines, as in: 148809 19:17:49.2937259s - Response from peer NTPMMK-E0.fmr.com (ntp.m|0x9|10.86.33.181:123->10.32.108.10:123), ofs: -00.0050404s Which message number would those be? Thanks!

  • Anonymous
    July 10, 2008
    Looking at the debug logs, I see lines like the following: 148830 21:03:50.5225236s - ---------- Log File Opened ----------------- The second field looks like the time.  I assume the first is a date, how do I convert it to month/day/year format. Thank You, Dan

  • Anonymous
    February 24, 2011
    The comment has been removed

  • Anonymous
    October 06, 2016
    I would like to know one thing why windows time is missing from windows services.If you have answer please let me know.Thanks,

    • Anonymous
      October 06, 2016
      Pyae -It seems like W32time was unregistered as a service on your machine. Assuming you are using Win7 or newer OS, you can re-register w32time by running the command "w32tm.exe /register" in an elevated command window. This will register W32time service as well. You can then start W32time using the command "net start w32time".Thanks,Sarath Madakasira (MSFT)