Tag Info

Hot answers tagged

323

This is caused by a livelock when ntpd calls adjtimex(2) to tell the kernel to insert a leap second. See lkml posting http://lkml.indiana.edu/hypermail/linux/kernel/1203.1/04598.html Red Hat should also be updating their KB article as well. https://access.redhat.com/knowledge/articles/15145 UPDATE: Red Hat has a second KB article just for this issue here: ...


33

This hit us hard. After restarting many of our hosts, the following turned out to be embarrassingly simple and fully effective without a host restart: /etc/init.d/ntp stop ntpdate 0.us.pool.ntp.org /etc/init.d/ntp start All that is required is to reset the system clock. Sheesh. What I've give to have known this six hours ago.


30

http://www.pool.ntp.org/ If you are in the US: United States — us.pool.ntp.org To use this pool zone, add the following to your ntp.conf file: server 0.us.pool.ntp.org server 1.us.pool.ntp.org server 2.us.pool.ntp.org server 3.us.pool.ntp.org Other pools around the world are available and can be found at the http://www.pool.ntp.org/ site.


24

A simple C program that clears the leap second bit in the kernel's time status field: #include <sys/timex.h> #include <string.h> #include <stdio.h> int main(int argc, char **argv) { struct timex txc; int ret; (void) argc; (void) argv; bzero(&txc, sizeof(txc)); txc.modes = 0; /* fetch */ ret = ...


23

In the old days, setting up a stratum-1 NTP server was very difficult, because stratum-0 sources were very expensive, extremely delicate, and usually radioactive. Nowadays we have the GPS, which incidentally functions as an extremely accurate radio clock. You can buy a dedicated stratum-1 server containing a GPS receiver as its stratum-0 timesource for ...


22

The NTP algorithm includes information to allow you to calculate and fix the drift in your server's clock. NTPD includes the ability to use this to keep your clock in sync and will run more accurately than a clock on a computer not running NTPD. NTPD will also use several servers to improve accuracy. ntpdate does not keep any state to perform this service ...


21

The Network Time Protocol, or NTP, can be used to synchronize the time on a server with an authoritative source. Windows Servers, for example, will use one of the network domain controllers (the DC which holds the PDC emulator FSMO role for the domain [thanks Graeme]) to get time information. You can configure the domain controller to get information from ...


20

This is easy to control. Configuration management is the key... Ensure that the ntp service is running and configured... For example, using Monit to make sure ntpd is running and to restart it if it fails is an easy approach... It may make sense to add cron and other essential daemons to that sort of check. Another option is using a configuration ...


19

As with most things, "it depends". Are all of your administrators/users in the same timezone? Perhaps their TZ would be appropriate. Do the machines interact with the local environment? Local TZ might be good. Are all the logs pulled to a central location for analysis? UTC might help there. Do the machines communicate with each other in ways where time ...


18

I would log everything in UTC (Coordinated Universal Time), this way daylight saving is never observed. It is the common default time setting for Linux servers. You can then present both the UTC and the local timezone time at the application layer. Reading about the tzdata package might be of interest to you. From that Wikipedia article: UTC does ...


18

Set everything to UTC. In addition to the examples user48838 mentioned, most things related to aviation are given in Zulu time (same as UTC/GMT). e.g. flight plans are filed with takeoff and landing times in UTC.


18

Postmortem it seems ./lsec does not have an effect. What we're seeing is lots of softirqd processes eating CPU (usually linear to the load of java processes) What does work to fix POSTMORTEM with leap seconds already applied by ntp is the following: It appears to be sufficient to just issue: export LANG="en_EN"; date -s "`date`" This should reduce the ...


17

You have the list of registry values here. Referring to this, try setting the following values : SpecialPollInterval : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient Explanation : Version : Windows XP, Windows Vista, Windows Server 2003, and Windows Server 2008 This entry specifies the special poll ...


17

http://my.opera.com/marcomarongiu/blog/2012/03/12/no-step-back seems to indicate that the Debian squeeze kernel won't handle the leap second. This thread on comp.protocols.tim.ntp is of interest, also: https://groups.google.com/forum/?fromgroups#!topic/comp.protocols.time.ntp/KSflIgjUdPE That said, the leap second hasn't happened yet: 23:59:60 UTC ...


16

The pool.ntp.org is a DNS-level load balancer. Jeff just happened to get directed to that one, the NTP pool maintainers do not care what does the server run on it's port 80 (http), only that it serves time via NTP correctly.


15

It is not promiscuous at all. It's just binding to the interface IP addresses and localhost, both on ipv4 and ipv6 protocols. If you think it should not be listening to some of those, just change the listen config as explained in the manual (this may be for a different version that you are using): listen on address Specify a local IP address or a ...


15

Connecting your ntpd to NTP servers outside your LAN to time sync can lead to the inconsistencies you are seeing, because every connection will have to go thru several routers, each one with unpredictable latencies depending on traffic. If each server connects by itself, the time between all the servers will drift a little. To avoid the inconsistency, the ...


14

Jeff, I found this article. Might be of some help to you. You might have already read this but I thought it was worth a shot. HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags This registry entry controls whether the local computer is marked as a reliable time server (which is only possible if the previous registry entry is set ...


14

You only need to set the time zone once: tzselect or dpkg-reconfigure tzdata NTP does not handle time zones. All time data handled by NTP is in UTC; your local time zone setting determines the offset from there.


14

These attacks have been around for ages, they just became popular again the last couple of months. They work like any regular amplification attack: a host spoofs a query so that the source IP address seems to be the targetted host. The NTP server sends its answer to the spoofed address. Since the answer for specific query types can be quite large and usually ...


13

Is it this problem? You need to look at /etc/default/rcS and change UTC=yes to UTC=no. This makes Ubuntu read and write to the hardware clock in the same way as Windows, using local time instead of UTC.


13

My advice would be to trust NTP -- It's by no means secure, but I'm not aware of any major attack vectors, and it's as secure as your selection of peers (which are in tern as secure as your DNS resolution and your routing table). If you need to consider other alternatives here are a few (accuracy/security in parentheses): Your own atomic clock as a PPS ...


13

ntpd doesn't sync time periodically the way you think it does, see here for more information (read the whole thing, it's all important. Short version: ntpd syncs the time and tells the system how fast it's drifting away from "true" time, the system then adjusts its clock frequency to properly track "true" time. Within a day most systems are tracking to ...


13

Unless extremely accurate timekeeping is mission-critical for you there should be no discernible effect for your users, aside from their clocks changing by 2 minutes. The possible exception is if they declare your NTP server to be "insane" as a result of the large change (which would require you to restart the NTP service on the affected systems to force ...


13

From my reading of this page, it appears that ntp doesn't use the INADDR_ANY 0.0.0.0 address exclusively partly for security reasons, and partly for authentication reasons. First port 123, is below 1024, and so is considered a privileged port, and only root can bind to that port. Ntp is typically set to drop privileges after it is started. From what I ...


12

Windows Time Agent is a free control panel applet for configuring the NTP server/synchronization ability of Windows. It acts as a front-end to the registry settings and lets you configure multiple NTP servers and see what sort of results you are getting from them in real-time. Not many people know about this particularly handy (and free) piece of software, ...


12

The simple fact is that clock accuracy within a VM is still really bad. This comes from a few spots, but the killer thing is that the time drift is not constant; the drift factor changes from moment to moment. NTP is a protocol that has clock compensation built within it, but it was designed with a static drift factor built in. For example, if a physical ...


12

NTP usually hovers in the <10-20ms range on a "reasonable" network. If you're using Windows built-in NTP client however, that's a different story. The Windows built-in client is only meant to keep the time synchronized enough for Kerberos, 5 minutes. They had no intention of keeping very accurate time; so 100ms is doing pretty good. If you need more ...


12

In a perfect world, your VM guests would keep perfect time, or at least as perfect as the host provides. Unfortunately we don't live in a perfect world. Based on my experience with virtually every hypervisor known to man, I always run an NTP client in virtual machines, without exception. My usual setup is ntpd with the -g option, or ntpdate starting right ...


12

You might have been bitten by an edge case for ntpd: IIRC ntpd versions < 4.2.4p3 removed any servers from it's synchronization list that couldn't be reached at some point. This is of course quite bad in this case, as ntpd might very well 'exhaust' the list of its peers before gaining internet connectivity. One could/can set the dynamic option for these ...



Only top voted, non community-wiki answers of a minimum length are eligible