{"record":{"id":"9bca3d5ff46345a4","repo":"databendlabs/databend","slug":"the-system-clock-is-not-properly-set","errorCode":null,"errorMessage":"The system clock is not properly set","messagePattern":"The system clock is not properly set","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/query/service/src/servers/http/v1/session/token.rs","lineNumber":49,"sourceCode":"    hex::encode(random_bytes)\n}\n\n#[derive(Serialize, Deserialize, Debug, Clone)]\npub struct SessionClaim {\n    pub tenant: String,\n    pub user: String,\n    pub auth_role: Option<String>,\n    #[serde(rename = \"sid\")]\n    pub session_id: String,\n    pub(crate) nonce: String,\n    #[serde(rename = \"exp\")]\n    pub expire_at_in_secs: u64,\n}\n\npub fn unix_ts() -> Duration {\n    SystemTime::now()\n        .duration_since(std::time::UNIX_EPOCH)\n        .expect(\"The system clock is not properly set\")\n}\n\nimpl SessionClaim {\n    pub fn new(\n        session_id: String,\n        tenant: &str,\n        user: &str,\n        auth_role: &Option<String>,\n        ttl: Duration,\n    ) -> Self {\n        SessionClaim {\n            tenant: tenant.to_string(),\n            user: user.to_string(),\n            auth_role: auth_role.clone(),\n            session_id,\n            nonce: generate_secure_nonce(),\n            expire_at_in_secs: (unix_ts() + ttl).as_secs(),\n        }","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/databendlabs/databend/blob/288d84d76e20a2f8f7173bda9691eb6ece301aa9/src/query/service/src/servers/http/v1/session/token.rs#L31-L67","documentation":"unix_ts() converts the current system time to a Duration since the UNIX epoch for session token claims. `SystemTime::now().duration_since(UNIX_EPOCH)` returns Err if the clock is set before 1970, so the expect panics. This guards token expire_at/issued-at computations from nonsense values.","triggerScenarios":"System clock set before 1970-01-01 (uninitialized RTC, wrong time in a fresh VM/container, NTP not yet synced) while issuing or refreshing session tokens.","commonSituations":"Embedded/fresh VMs booting with default BIOS time; containers started with a skewed clock; NTP sync delayed at startup; manually mis-set system date.","solutions":["Fix the system clock: enable NTP (chrony/systemd-timesyncd) and wait for sync before starting databend-query.","Verify with `date -u` that the time is after 1970.","In containers/VMs, ensure the host clock is correct and RTC is set.","Optionally patch unix_ts to fall back to Duration::ZERO with a warning instead of panicking."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# before starting databend-query\n[ $(date -u +%s) -gt 0 ] || { echo \"system clock is before UNIX epoch\"; exit 1; }","typeGuard":"fn clock_is_sane() -> bool { std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).is_ok() }","tryCatchPattern":"let ts = SystemTime::now().duration_since(UNIX_EPOCH).unwrap_or_default();","preventionTips":["Enable NTP/time sync on all query nodes","Check `date -u` after VM/container boot before starting services","Set RTC/BIOS clock on bare metal","Alert on clock-skew monitoring"],"tags":["rust","panic","time","environment","clock"],"backgroundTag":"missing-env-var","analyzedSha":"288d84d76e20a2f8f7173bda9691eb6ece301aa9","analyzedAt":"2026-09-11T11:29:36.208Z","contentChangedAt":"2026-09-11T11:29:36.208Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}