hi osquery team, could you share where does osquery fetch the info of table time? local or ntp server?

Neither. It’s talking to the host. Read the source code if you want to find the system calls,