Azure 中 Windows VM 的时间同步Time sync for Windows VMs in Azure

时间同步对于安全性和事件相关性来说很重要。Time sync is important for security and event correlation. 有时候,它用于分布式事务实现。Sometimes it is used for distributed transactions implementation. 多个计算机系统之间的时间准确性通过同步来实现。Time accuracy between multiple computer systems is achieved through synchronization. 同步可能受多种因素影响,包括重启以及时间源和提取时间的计算机之间的网络流量。Synchronization can be affected by multiple things, including reboots and network traffic between the time source and the computer fetching the time.

Azure 现在受运行 Windows Server 2016 的基础设施的支持。Azure is now backed by infrastructure running Windows Server 2016. Windows Server 2016 已改进用于纠正时间和条件的算法,方便本地时钟与 UTC 同步。Windows Server 2016 has improved algorithms used to correct time and condition the local clock to synchronize with UTC. Windows Server 2016 还改进了 VMICTimeSync 服务,该服务用于控制 VM 与主机的同步方式,以确保时间准确。Windows Server 2016 also improved the VMICTimeSync service that governs how VMs sync with the host for accurate time. 改进包括增强 VM 启动或 VM 还原的初始时间的准确性,以及纠正提供给 Windows 时间 (W32time) 服务的示例的中断延迟。Improvements include more accurate initial time on VM start or VM restore and interrupt latency correction for samples provided to Windows Time (W32time).

备注

有关详细信息,请参阅 Windows Server 2016 的准确时间For more information, see Accurate time for Windows Server 2016.

概述Overview

计算机时钟的准确性根据计算机时钟与协调世界时 (UTC) 时间标准的接近程度来测量。Accuracy for a computer clock is gauged on how close the computer clock is to the Coordinated Universal Time (UTC) time standard. UTC 通过精确原子钟的跨国样本来定义,此类原子钟 300 年的偏差只有 1 秒。UTC is defined by a multinational sample of precise atomic clocks that can only be off by one second in 300 years. 但是,直接读取 UTC 需要专用硬件。But, reading UTC directly requires specialized hardware. 而时间服务器与 UTC 同步,可以从其他计算机访问,因此具备可伸缩性和可靠性。Instead, time servers are synced to UTC and are accessed from other computers to provide scalability and robustness. 每个计算机都有时间同步服务运行,该服务知道使用什么时间服务器,并定期检查计算机时钟是否需纠正,然后根据需要调整时间。Every computer has time synchronization service running that knows what time servers to use and periodically checks if computer clock needs to be corrected and adjusts time if needed.

Azure 主机与内部 Azure 时间服务器同步,后者从 Microsoft 拥有的带 GPS 天线的第 1 层设备获取其时间。Azure hosts are synchronized to internal Azure time servers that take their time from Microsoft-owned Stratum 1 devices, with GPS antennas. Azure 中的虚拟机可以依赖其主机来获取准确的时间(主机时间),也可以直接从时间服务器获取时间,或者同时采用这两种方法。Virtual machines in Azure can either depend on their host to pass the accurate time (host time) on to the VM or the VM can directly get time from a time server, or a combination of both.

虚拟机与主机的交互也可能影响时钟。Virtual machine interactions with the host can also affect the clock. 内存保留维护期间,VM 会暂停最多 30 秒的时间。During memory preserving maintenance, VMs are paused for up to 30 seconds. 例如,在维护开始之前,VM 时钟显示上午 10:00:00,这种状态会持续 28 秒。For example, before maintenance begins the VM clock shows 10:00:00 AM and lasts 28 seconds. 在 VM 恢复后,VM 上的时钟仍显示上午 10:00:00,这样就造成 28 秒的偏差。After the VM resumes, the clock on the VM would still show 10:00:00 AM, which would be 28 seconds off. 为了进行纠正,VMICTimeSync 服务会监视主机上发生的情况,并会提示用户在 VM 上进行更改以纠正时间偏差。To correct for this, the VMICTimeSync service monitors what is happening on the host and prompts for changes to happen on the VMs to compensate.

VMICTimeSync 服务以采样或同步模式运行,只会影响时钟前进。The VMICTimeSync service operates in either sample or sync mode and will only influence the clock forward. 在需要运行 W32time 的采样模式下,VMICTimeSync 服务每 5 秒轮询主机一次并向 W32time 提供时间样本。In sample mode, which requires W32time to be running, the VMICTimeSync service polls the host every 5 seconds and provides time samples to W32time. W32time 服务大约每隔 30 秒就会抽取一次最新的时间样本并使用它来影响来宾的时钟。Approximately every 30 seconds, the W32time service takes the latest time sample and uses it to influence the guest's clock. 如果来宾已被恢复,或者来宾的时钟比主机时钟慢 5 秒以上,则将激活同步模式。Sync mode activates if a guest has been resumed or if a guest's clock drifts more than 5 seconds behind the host's clock. 在 W32time 服务正常运行的情况下,后一种情况应永远不会发生。In cases where the W32time service is properly running, the latter case should never happen.

如果不进行时间同步,VM 上的时钟会累积错误。Without time synchronization working, the clock on the VM would accumulate errors. 只有一个 VM 时,效果可能不明显,除非工作负荷要求极为准确的计时。When there is only one VM, the effect might not be significant unless the workload requires highly accurate timekeeping. 但在大多数情况下,我们有多个互连的 VM,这些 VM 使用时间来跟踪事务,因此需确保整个部署的时间一致。But in most cases, we have multiple, interconnected VMs that use time to track transactions and the time needs to be consistent throughout the entire deployment. 当 VM 之间的时间不同时,可能会造成以下影响:When time between VMs is different, you could see the following effects:

  • 身份验证会失败。Authentication will fail. 安全协议(如 Kerberos)或依赖于证书的技术要求跨系统确保时间一致性。Security protocols like Kerberos or certificate-dependent technology rely on time being consistent across the systems.
  • 如果日志(或其他数据)在时间上不一致,则很难弄清楚系统中发生了什么。It's very hard to figure out what have happened in a system if logs (or other data) don't agree on time. 同一事件看起来就像是在不同的时间发生,难以进行关联。The same event would look like it occurred at different times, making correlation difficult.
  • 如果时钟存在偏差,则可能造成计费不正确。If clock is off, the billing could be calculated incorrectly.

可以将 Windows Server 2016 用作来宾操作系统,这样可确保使用时间同步方面的最新改进,获得 Windows 部署的最佳结果。The best results for Windows deployments are achieved by using Windows Server 2016 as the guest operating system, which ensures you can use the latest improvements in time synchronization.

配置选项Configuration options

可以通过三个选项来配置托管在 Azure 中的 Windows VM 的时间同步:There are three options for configuring time sync for your Windows VMs hosted in Azure:

  • 主机时间和 time.windows.com。Host time and time.windows.com. 这是在 Azure 市场映像中使用的默认配置。This is the default configuration used in Azure Marketplace images.
  • 仅主机。Host-only.
  • 在使用或不使用主机时间的情况下,使用另一外部时间服务器。Use another, external time server with or without using host time.

使用默认值Use the default

默认情况下,Windows OS VM 映像配置为允许 w32time 与两个源同步:By default Windows OS VM images are configured for w32time to sync from two sources:

  • NtpClient 提供程序,从 time.windows.com 获取信息。The NtpClient provider, which gets information from time.windows.com.
  • VMICTimeSync 服务,用于将主机时间传递给 VM,并在 VM 因维护而暂停后进行纠正。The VMICTimeSync service, used to communicate the host time to the VMs and make corrections after the VM is paused for maintenance. Azure 主机使用 Microsoft 拥有的 Stratum 1 设备来保持准确的时间。Azure hosts use Microsoft-owned Stratum 1 devices to keep accurate time.

w32time 会按以下优先级顺序来首选时间提供程序:层次级别、根延迟、根分散、时间偏差。w32time would prefer the time provider in the following order of priority: stratum level, root delay, root dispersion, time offset. 在大多数情况下,Azure VM 上的 w32time 会首选主机时间,因为它会进行评估以比较两个时间源。In most cases, w32time on an Azure VM would prefer host time due to evaluation it would do to compare both time sources.

对于已加入域的计算机来说,域本身已建立时间同步层次结构,但林根仍需从某个位置获取时间,因此仍需考虑以下注意事项。For domain joined machines the domain itself establishes time sync hierarchy, but the forest root still needs to take time from somewhere and the following considerations would still hold true.

仅主机Host-only

由于 time.windows.com 是公共 NTP 服务器,与其同步时间需要通过 Internet 发送流量,而数据包的延迟各不相同,因此可能会对时间同步的质量造成负面影响。通过切换到“仅主机”同步来删除 time.windows.com 有时候可以改善时间同步结果。Because time.windows.com is a public NTP server, syncing time with it requires sending traffic over the internet, varying packet delays can negatively affect quality of the time sync. Removing time.windows.com by switching to host-only sync can sometimes improve your time sync results.

如果在使用默认配置时遇到时间同步问题,则可切换到“仅主机”时间同步。Switching to host-only time sync makes sense if you experience time sync issues using the default configuration. 尝试“仅主机”同步,看是否会改进 VM 上的时间同步。Try out the host-only sync to see if that would improve the time sync on VM.

外部时间服务器External time server

如果有特定的时间同步要求,则可使用另一选项,即,使用外部时间服务器。If you have specific time sync requirements, there is also an option of using external time servers. 外部时间服务器可以提供特定的时间,这可以用于测试方案,确保时间在非 Microsoft 数据中心托管的计算机中的一致性,或者以特殊方式来处理闰秒问题。External time servers can provide specific time, which can be useful for test scenarios, ensuring time uniformity with machines hosted in non-Microsoft datacenters, or handling leap seconds in a special way.

可以将外部服务器与 VMICTimeSync 服务和 VMICTimeProvider 组合使用,提供类似于默认配置的结果。You can combine external servers with the VMICTimeSync service and VMICTimeProvider to provide results similar to the default configuration.

检查配置Check your configuration

检查是否已将 NtpClient 时间提供程序配置为使用显式 NTP 服务器 (NTP) 或域时间同步 (NT5DS)。Check if the NtpClient time provider is configured to use explicit NTP servers (NTP) or domain time sync (NT5DS).

w32tm /dumpreg /subkey:Parameters | findstr /i "type"

如果 VM 使用 NTP,则会看到以下输出:If the VM is using NTP, you will see the following output:

Value Name                 Value Type          Value Data
Type                       REG_SZ              NTP

若要查看 NtpClient 时间提供程序正在使用什么时间服务器,请在权限提升的命令提示符处键入以下命令:To see what time server the NtpClient time provider is using, at an elevated command prompt type:

w32tm /dumpreg /subkey:Parameters | findstr /i "ntpserver"

如果 VM 使用的是默认值,则输出将如下所示:If the VM is using the default, the output will look like this:

NtpServer                  REG_SZ              time.windows.com,0x8

若要查看当前正使用什么时间提供程序,请键入以下命令:To see what time provider is being used currently.

w32tm /query /source

下面是可能会看到的输出及其含义:Here is the output you could see and what it would mean:

  • time.windows.com - 在默认配置中,w32time 会从 time.windows.com 获取时间。time.windows.com - in the default configuration, w32time would get time from time.windows.com. 时间同步质量取决于到它的 Internet 连接,受数据包延迟的影响。The time sync quality depends on internet connectivity to it and is affected by packet delays. 这是你将在物理计算机上获得的常见输出。This is the usual output you would get on a physical machine.
  • VM IC 时间同步提供程序 - VM 与主机同步时间。VM IC Time Synchronization Provider - the VM is syncing time from the host. 这是你将在 Azure 中运行的虚拟机上获得的常见输出。This is the usual output you would get on a virtual machine running on Azure.
  • 你的域服务器 - 当前计算机位于某个域中,该域定义时间同步层次结构。Your domain server - the current machine is in a domain and the domain defines the time sync hierarchy.
  • 某个其他的服务器 - w32time 已显式配置为从该服务器获取时间。Some other server - w32time was explicitly configured to get the time from that another server. 时间同步质量取决于该时间服务器质量。Time sync quality depends on this time server quality.
  • 本地 CMOS 时钟 - 时钟未同步。Local CMOS Clock - clock is unsynchronized. 如果 w32time 在重启后还没有足够的时间启动,或者所有配置的时间源均不可用,则可能获得此输出。You can get this output if w32time hasn't had enough time to start after a reboot or when all the configured time sources are not available.

选择启用“仅主机”时间同步Opt-in for host-only time sync

Azure 始终致力于改进主机上的时间同步,确保所有时间同步基础设施并置在 Azure 拥有的数据中心。Azure is constantly working on improving time sync on hosts and can guarantee that all the time sync infrastructure is collocated in Azure-owned datacenters. 如果首选使用 time.windows.com 作为主时间源的默认设置有时间同步问题,可通过以下命令来选择启用“仅主机”时间同步。If you have time sync issues with the default setup that prefers to use time.windows.com as the primary time source, you can use the following commands to opt-in to host-only time sync.

将 VMIC 提供程序标记为“已启用”。Mark the VMIC provider as enabled.

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\VMICTimeProvider /v Enabled /t REG_DWORD /d 1 /f

将 NTPClient 提供程序标记为“已禁用”。Mark the NTPClient provider as disabled.

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\TimeProviders\NtpClient /v Enabled /t REG_DWORD /d 0 /f

重启 w32time 服务。Restart the w32time Service.

net stop w32time && net start w32time

Windows Server 2012 和 R2 VMWindows Server 2012 and R2 VMs

Windows Server 2012 和 Windows Server 2012 R2 对于时间同步有不同的默认设置。w32time 默认配置为首选降低服务的开销而不是提高其时间准确度。Windows Server 2012 and Windows Server 2012 R2 have different default settings for time sync. The w32time by default is configured in a way that prefers low overhead of the service over to precise time.

若要移动 Windows Server 2012 和 2012 R2 部署,以便使用首选提高时间准确度的较新默认设置,则可应用以下设置。If you want to move your Windows Server 2012 and 2012 R2 deployments to use the newer defaults that prefer precise time, you can apply the following settings.

请更新 w32time 轮询和更新时间间隔,使之与 Windows Server 2016 设置匹配。Update the w32time poll and update intervals to match Windows Server 2016 settings.

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\Config /v MinPollInterval /t REG_DWORD /d 6 /f
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\Config /v MaxPollInterval /t REG_DWORD /d 10 /f
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time\Config /v UpdateInterval /t REG_DWORD /d 100 /f
w32tm /config /update

为了让 w32time 能够使用新的轮询时间间隔,需将 NtpServers 标记为使用它们。For w32time to be able to use the new poll intervals, the NtpServers need to be marked as using them. 如果使用 0x1 位标志掩码对服务器进行批注,则会替代此机制,w32time 会改用 SpecialPollInterval。If servers are annotated with 0x1 bitflag mask, that would override this mechanism and w32time would use SpecialPollInterval instead. 请确保指定的 NTP 服务器使用 0x8 标志或根本不使用任何标志:Make sure that specified NTP servers are either using 0x8 flag or no flag at all:

检查哪些标志正用于已使用的 NTP 服务器。Check what flags are being used for the used NTP servers.

w32tm /dumpreg /subkey:Parameters | findstr /i "ntpserver"

后续步骤Next steps

下面是有关时间同步的更多详细信息的链接:Below are links to more details about the time sync: