Uptime can jump when date is adjusted for devices without RTC

[Gui13]

Describe the bug

Related to influxdata/telegraf#7018

When a device starts at a wrong date (say epoch, or another more recent date reported by fake_hwclock for instance), and the date is later adjusted to the real one with NTP, gopsutil starts reporting wrong uptime.

To Reproduce

Uptime() // reports 30s uptime
/* 1 second elapses but NTP adjusts the date 24h in the future */
Uptime() // reports 1 day an 31s uptime

Expected behavior

Do not use a differential computation for linux devices, maybe prefer parsing the /proc/uptime ?
Or at least try to detect large time slippage and reset the boot time ?

Environment (please complete the following information):

• Linux: PRETTY_NAME="Raspbian GNU/Linux 10 (buster) / Linux eanode5 4.19.75-v7+ [disk][linux] add fallback to /proc/self #1270 SMP Tue Sep 24 18:45:11 BST 2019 armv7l GNU/Linux

Additional context
Device has no RTC (Raspberry Pi 3 A+)

[Gui13]

By the way, reading /proc/uptime yields the correct uptime value (as seen in the telegraf bug), so the kernel has a way to differentiate uptime and clock time somehow.

[mznet]

@Gui13 As refer to your issue, the uptime method computes with a diff from boot time to now. The result of now method is a kind of clock wall and it could be affected by NTP. To get a consistent uptime, parsing uptime from /proc/uptime, which is a monotonic, would be better.

[Gui13]

Nobody got news about that ?

[Gui13]

Ok that was a bit hash. Would you be open to a PR that fixes this issue ?

[Lomanic]

Sorry, forgot to reply to this issue, but I was fearing we would have a similar side effect as described in giampaolo/psutil#658 (comment), for process creation time, which is used in IsRunningWithContext (psutil checks if this is the same process before terminating it and some other functions, this is not the case for gopsutil, for the moment).

What I fear is that process.IsRunning() would return false if called after ntpd adjusts the clock, for all processes, if NewProcess() is called before the clock is adjusted. I have an old Raspberry Pi for testing this, if I disable ntpd service and only launch it manually, I should be able to reproduce according to your report.

[Gui13]

If you need me to test something, I have many RPis laying around.