This dashboard is what we view as a simple yet detailed view of a host's performance. Unlike the Device Information dashboard, the Single Host dashboard provides all the necessary performance metrics in a simple, no noise, digestible format.
Time Metics for <host ID>:
The above view shows our main metrics that Timebeat logs, offset, source variance, and clock performance. This dashboard solely looks at the system clock and therefore is typically the most valuable to understand quickly and easily as this is where you would be concerned for most compliance regulations and other performance monitoring excercises.
The offset graph displays the level of accuracy or deviation from UTC. This is one of the most important graphs of Timebeat as this is the aim of the game, to keep this line stable and as close to zero as possible.
Below the offset graph, you have the source variance and clock performance graphs.
Source variance is a value that is only available if you have more than 1 Primary source of UTC. This is a value of the range between sources, i.e. how well they agree with each other. The goal is to keep this line consistent and again close to zero. In practice, this graph is unlikely to read zero when there are multiple sources of UTC as each source is likely to have its own offset error.
The Clock performance graph details the smallest increment in time your system can represent, this is sometimes referred to as Granularity. most systems will have a fairly consistent clock performance although when the system is under load you can expect to see spikes. This is of particular interest to understand if your offset has spiked as well, as it can have a direct correlation to system load.
Primary & Secondary Time Sources:
Primary and Secondary sources of time are fairly self-explanatory. These relate directly to your Source Configuration within the timebeat.yml file. In practice we are interested in the primary sources most of the time, these are the sources of UTC used for clock synchronisation.
The secondary sources are only used in the event all primary sources have ceased function. When the secondary sources become active they will remain logging as secondary sources so as not to add confusion, however, an annotation will be logged which can be alerted against to notify you that the secondary sources are now the active sources. For more on annotations look here.