ipfixcol2-timecheck-output(7)

✨ ipfixcol2-timecheck-output ✨

okay bestie, so this is a page from the ipfixcol2-timecheck-output(7) manual — it's literally the glow-up guide for the Time Check output plugin 💅

---

🎀 NAME 🎀

ipfixcol2-timecheck-output — Time Check (output plugin) ⏰✨

---

💖 DESCRIPTION 💖

So what this plugin does is: it checks that the start and end timestamps of every single flow record are, like, relatively recent 🦋. Based on the parameters you configure, it snitches on flows whose timestamps are from the future (meaning greater than the current system time, hello?? time traveler much 😭) and also flows with timestamps from the distant past.

Where do these timestamp anomalies even come from? Usually it's giving missing clock synchronization (like NTP bestie, pls) or an invalid implementation on the side of the exporter 🙈. And if the anomaly gets detected, the plugin prints the details on the standard output. periodt.

ngl, only these specific standard IANA timestamps are supported — no others, don't even try:

• ID 150 (flowStartSeconds)
• ID 151 (flowEndSeconds)
• ID 152 (flowStartMilliseconds)
• ID 153 (flowEndMilliseconds)
• ID 154 (flowStartMicroseconds)
• ID 155 (flowEndMicroseconds)
• ID 156 (flowStartNanoseconds)
• ID 157 (flowEndNanoseconds)

---

🌸 EXAMPLE CONFIGURATION 🌸

here's the vibe check, copy it exactly bestie:

<output>
    <name>TimeCheck output</name>
    <plugin>timecheck</plugin>
    <params>
        <devPast>600</devPast>
        <devFuture>0</devFuture>
    </params>
</output>

---

🦋 PARAMETERS 🦋

• devPast — the maximum allowed deviation (in seconds) between the current system time and timestamps from the past. The way this works: your value must be greater than the active and inactive timeouts of the exporters, and it must also cover any possible delay between expiration and processing on the collector. For example — let's say active timeout is 5 minutes and inactive timeout is 30 seconds. Then value 600 (that's 10 minutes btw, math girlies rise) should always be enough for all the flow data to be received and processed at the collector 👑
• devFuture — the maximum allowed deviation (again, in seconds) between the current time and timestamps from the future. And like... the collector should never receive flows with a timestamp from the future, so this value should usually be set to 0. no cap.

---

🫶 AUTHOR 🫶

Lukáš Huták (lukas.hutak@cesnet.cz) — iconic behavior honestly 💜

---

👑 COPYRIGHT 👑

Copyright © 2019 CESNET, z.s.p.o.

---

aaaand that's the whole page bestie, ate and left no crumbs 💅✨ version 2.0, dated 2019-03-01, brought to you by the ipfixcol2-timecheck-output(7) girlies — go sync your clocks fr fr 🕐💖