10

Due to combined use of Debian stretch, that uses systemd by default, and sdwdate (that uses Slow Clock Adjuster ( gh )), my system clock is frequently changed.

As a result journalctl -f gets endlessly spammed by.

[...]
Nov 07 13:46:49 host systemd[766]: Time has been changed
Nov 07 13:46:50 host systemd[766]: Time has been changed
Nov 07 13:46:51 host systemd[766]: Time has been changed
[...]

This was not an issue on Debian wheezy that used sysvinit.

How can systemd be configured to not send the Time has been changed message to the journal?

A related question How to disable systemd's "Time has been changed" message spam in /var/log/syslog on Debian jessie? has been solved, but that solution won't work here.

  • systemd cares deeply about timers. This appears to be triggered by updating the hardware clock e.g. hwclock --systohc, are you calling that every second? – mr.spuratic Nov 11 '14 at 18:31
  • @mr.spuratic looking at the linked source, that seems to be exactly what's happening. – Dan Getz Nov 11 '14 at 19:16
  • Yes, that is what slow clock adjust (sclockadj) is doing. @mr.spuratic – adrelanos Nov 11 '14 at 22:43
  • 1
    systemd feature request: option to disable systemd's “Time has been changed” message spam in journal log github.com/systemd/systemd/issues/5207 – adrelanos Feb 2 '17 at 12:56
9
+200

The message comes from src/core/manager.c in the systemd sources. It is hardcoded to use INFO system logging level.

By default systemd logs messages that have INFO level, if you can change that by changing /etc/systemd/system.conf to:

LogLevel=notice

but you will lose quite a few of other informational messages as well.

It might be best to patch src/core/manager.c to read:

 log_struct(LOG_DEBUG,
            MESSAGE_ID(SD_MESSAGE_TIME_CHANGE),
            "MESSAGE=Time has been changed",
            NULL);

(LOG_DEBUG is defined as the next higher, and highest level in sys/syslog.h), or comment out the whole message.

I haven't found a way to only report timer changes that have a minimum size of X seconds. But if that is possible that would undoubtedly make for a more complex and error prone patch.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.