Diagnostics — time#

The Time tab answers whether the router knows what time it is and where it is getting that from. It is a read-only view; the editor for NTP is on System → Settings.

GET /api/ntp returns two things — the service ntp configuration subtree, and the parsed output of show ntp — and the tab polls it every 30 s. handleNTP in agent/opmode.go carries a one-line comment that is the whole reason this tab exists: a router with a wrong clock breaks TOTP, certificate validation and every log correlation.

Configured servers#

The left panel lists the keys under service ntp server — the servers the configuration asks the router to use. When there are none it says so plainly:

No NTP servers configured. The router is trusting whatever its clock says.

That is the state a freshly installed router can be in, and it is worth fixing before anything else. Add servers on System → Settings, which stages:

set service ntp server time.example.com
set service ntp server time.example.com pool
set service ntp server time.example.com prefer
set service ntp server time.example.com nts

pool, prefer and nts are optional flags on each server; nts needs the server to support authenticated time.

Router clock#

The right panel is three rows, and it is honest about which side each came from:

Row	Value
Uptime	The router's uptime, from `GET /api/system`.
Your browser	The browser's own local date and time.
Timezone (browser)	The browser's resolved time zone.

The router's configured time zone is a separate thing again — system time-zone, shown and edited on System → Settings.

Synchronisation sources#

The lower panel is the parsed output of show ntp, one row per source, with whatever columns the router printed. When the output could not be parsed into a table, the raw text is printed instead — which is a deliberate fallback: the sentence a daemon prints when it has no sources is more useful than an empty table.

Reading it: a source the daemon has selected, a reachability field that is not zero, and an offset in milliseconds rather than seconds is a healthy picture. A router with configured servers and no sources here has an outbound path problem — UDP/123 blocked upstream is the usual cause.

What a wrong clock breaks#

Three things, in the order you will notice them.

Two-factor authentication. TOTP codes are derived from the current time in 30-second steps. A router whose clock is minutes out rejects every correct code, and the failure looks like a wrong password.

Certificate validation. Anything the router validates by date — the licence server's certificate, an ACME order, an IPsec peer certificate — fails on a clock that reads before the certificate's start or after its end.

Log correlation. Every timestamp in the journal, the audit log and the commit history comes from this clock. Correlating a router incident with anything else requires the clocks to agree.

What this tab will not do#

It does not set the clock. There is no "sync now" and no manual time entry. Time configuration is staged like any other change.
It does not show the router's wall clock, as above.
It does not warn on drift. Nothing compares the router's time to yours and flags a difference. Read the sources table.
It does not configure the router as a time server for clients — that is the Serve time on and Allowed clients controls on System → Settings.