Checking if NTP is running and working across a group of servers

Question

I've got an internal network with servers running different operating systems and all are supposedly synched via NTP, but I'd like to check that they are indeed synced. Is there a tool (preferably a Linux tool) for doing so?

Answer 1

This depends on the variety of servers permitting status queries from outside. Not all do. Windows in particular can't respond to standard NTP status requests. If they don't, you'll have to add the polling server to the NTP configuration's allow list if that's possible at all.

For those that do respond, the ntpq command is designed to do exactly that.

ntpq -c lo $target

You'll have to parse the output, but this can be combined with a bit of nmap scripting to identify the up hosts with open NTP hosts to query.

Or you can use an actual monitoring framework.

Answer 2

Nagios has a plugin for NTP. It will connect to the NTP server on the target system, and compare its time to the local time. You can set warning and critical levels for the time difference.

Answer 3

Assuming the servers haven't been configured to ignore the local network, you can from a central box do

central% /usr/sbin/ntptrace remotehost

And you should see something like

remotehost: stratum 3, offset 0.002664, synch distance 0.120534

If your local firewall allows random NTP traffic out onto the internet, you'll see more, perhaps something like:

remotehost: stratum 3, offset 0.005108, synch distance 0.085819
maverick.mcc.ac.uk: stratum 2, offset -0.000428, synch distance 0.032754
ntp2.ja.net: stratum 1, offset 0.000083, synch distance 0.002045, refid 'MSF'

If you see nothing, it means that ntp has been configured to ignore you; you may have to log onto the box to run ntptrace there. The problems are when someone's come unbound:

bustedbox: stratum 16, offset 0.000000, synch distance 0.000015