ProxySQL is using CLOCK_MONOTONIC clock in clock_gettime() .
This is due to historical reasons: CLOCK_MONOTONIC_RAW is available since Linux 2.6.28 , and although Linux 2.6.28 was already EOL from several years when ProxySQL development started, many widely used distros were still using Linux 2.6.18 .

The problem with CLOCK_MONOTONIC clock in clock_gettime() is that (quoting) "is affected by the incremental adjustments performed by adjtime() and NTP" .

De facto, this makes CLOCK_MONOTONIC clock not monotonic.
This means that two calls to clock_gettime() may result in the 2nd value being smaller than the 1st.

This is probably the cause of queries logged with a "negative" execution time (very large value, being unsigned long long) in stats_mysql_query_digest .

Proposed solutions:

• use CLOCK_MONOTONIC_RAW when available, and fall back to CLOCK_MONOTONIC otherwise
• when logging query execution time, re-evaluate "end time" if it is detected that "start time" is bigger than "end time" (or set the difference to 0)