I only know the following regarding NTP. So, MX will use public NTP to sync time and is heavily dependent on it. If the MX will not be able to reach any NTP server it uses, it will reboot (don't ask me how I know this). So, I am not sure how you can perform audit stuff but whats I want to say is that as long as the MX is working then it reaches NTP and most probably is synced. I also don't know why would you really need it - since all events in Dashboard will most probably use cloud time instead of device time.   Roman ... View more