1

nomenclature info:

  • machine - physical on virtual PC
  • server - an application run on a machine to be accessed by clients

Hello,

we started monitoring delays in requests between our proxy server(NGINX) and our application server(Apache) - each on different virtual machine. With it arose the issue of synchronizing time between the two machines.

In particular we add a header on out proxy server with the current system time and this header is then processed by New Relic APM on the application machine. This in known in New Relic as "Request Queuing".

Our infrastructure provider inform me that the synchronization right now is done from the ESX servers. He also suggested to install a NTP server on the proxy server machine to get better results.

Right now we have these machines in a virtual local network:

  • proxy machine (only one connected to outside world) - NGINX
  • application machine - LA(M)P stack
  • DB machine - with MySQL
  • DB replica machine - DB machine back-up storage
  • dev machine - GIT and CI+CD servers.

My question is: "Is hosting out own NTP server a good idea for this set up?" and if so, on which machine should it be hosted? Is the proxy machine the best place for it? Or it there some other possibility for synchronizing the clock?

Improve this question
4
  • Doesn't directly answer so putting as a comment, but I would just an ntp.org pool destination on all your servers and not bother running one yourself. It's just one more thing to look after. See here for setup instructions: pool.ntp.org/en/use.html
    – SimonJGreen
    Aug 19, 2016 at 22:21
  • 1
    There is no harm in hosting your own NTP servers. That said, you should have 2 per environment and each should have 4 to 7 unique stratum 1 servers as your upstream, that are less than 40ms away. When you see "Restricted", ignore that, it doesn't mean what most people think it means. Just dont use iburst/burst, dont ignore kod packets and you will be ok. Your NTP servers should be on devices that have constant CPU usage (not bursty CPU). Non-virtual machines are prefered to minimize clock skew deviations and corrections. Dont define the same st1 server on more than 1 host.
    – Aaron
    Aug 19, 2016 at 23:07
  • From my practical expirience with NTP and virtual infrastructure (ESXi) - put a least 2 NTP servers, the more the better as they better work in groups. When running only a few NTP servers I have often run into situation they lost sync with pool.ntp.org for days and weeks.
    – Anton Krouglov
    Aug 22, 2016 at 11:09
  • I have just found out, that the time discrepancy with ESX servers is over 2 minutes. Which is absolutely unacceptable. I hope that with NTP servers I get the level of tens to hundreds of ms.
    – Patrick Kusebauch
    Aug 22, 2016 at 21:47

1 Answer 1

Reset to default
0

I wonder why relying on your hypervisor to sync time isn't good enough? Are you actually having a problem? Maybe the hypervisor or vhost configuration is messed up? If you feel you need an ntp service, go ahead. There's nothing wrong with running it for yourself.

Don't you have a firewall of some sort? That's often where I see ntp services placed.

None of your servers are ideal candidates for an ntp daemon, but/so really you can put it anywhere. You can also go without and query a 3rd party ntp server (maybe your ISP?), but that would not give you the same level of accuracy as if you ran it yourself. Or, run it on your hypervisor (host OS) if you own it.

Really it's a matter of choice. In my experience, ntp services would run on something central, that provides other similar services - like a firewall.

I don't know how much this article applies to your situation, but it discusses time control in ESX including host->guest synchronization and NTP:

http://www.expta.com/2011/07/fixing-time-errors-on-vmware-vsphere.html

Improve this answer
1
  • I am suspecting the proxy machine is slightly ahead of the application machine, since I am getting 0 ms delay between the request time on NGINX and the New Relic PHP monitor. And I simply don't believe it takes 0 ms to finish the request processing on NGINX, send it to the application machine, be picked-up by the Apache server, Run the Apache vhost and mod_rewrite configuration and fire up the mod_php, when the queuing time is stopped by the New Relic Monitor.
    – Patrick Kusebauch
    Aug 19, 2016 at 22:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .