ntp server cannot sync clients

NdAd · 07-09-2010, 04:40 PM

hi all,

maybe you guys can help since i've tried almost everything here.
I have 2 servers that act as ntp servers, both in cluster.
i've configued to each client 2 servers and only one of the servers doing me an hard time, the other works perfectly.

here's some output from the client:

Code:

[root@host1 ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 ntp1            .INIT.          16 u    - 1024    0    0.000    0.000   0.000
*ntp2            LOCAL(0)        10 u  227  256  377    0.157    2.459   0.813

[root@host1 ~]# ntpdate -b ntp1  
 9 Jul 15:29:42 ntpdate[19725]: no server suitable for synchronization found
[root@host1 ~]# ntpdate -b ntp2
 9 Jul 15:29:45 ntpdate[19734]: step time server 172.17.201.5 offset 0.002892 sec
[root@host1 ~]# 
[root@host1 ~]# ntpstat
synchronised to NTP server (172.17.201.5) at stratum 11 
   time correct to within 29 ms
   polling server every 256 s

in ntp.conf I commented out most of the lines to eliminate the problem:

Code:

[root@host1 ~]# cat /etc/ntp.conf
# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
#restrict default kod nomodify notrap nopeer noquery
#restrict -6 default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1 
restrict -6 ::1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).

#broadcast 192.168.1.255 key 42         # broadcast server
#broadcastclient                        # broadcast client
#broadcast 224.0.1.1 key 42             # multicast server
#multicastclient 224.0.1.1              # multicast client
#manycastserver 239.255.254.254         # manycast server
#manycastclient 239.255.254.254 key 42  # manycast client

# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available. 
server  ntp1
server  ntp2
fudge   127.127.1.0 stratum 10

# Drift file.  Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
driftfile /var/lib/ntp/drift

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography. 
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

some output from the server (ntp1) :

Code:

[root@ntp1 etc]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*LOCAL(0)        .LOCL.          10 l   27   64  377    0.000    0.000   0.001

[root@ntp1 etc]# ntpstat
synchronised to local net at stratum 11 
   time correct to within 11 ms
   polling server every 1024 s

[root@ntp1 etc]# netstat -anp | grep 123
udp        0      0 192.168.1.1:123             0.0.0.0:*                               16222/ntpd          
udp        0      0 172.22.1.154:123            0.0.0.0:*                               16222/ntpd          
udp        0      0 172.22.1.152:123            0.0.0.0:*                               16222/ntpd          
udp        0      0 172.17.201.8:123            0.0.0.0:*                               16222/ntpd          
udp        0      0 172.17.201.6:123            0.0.0.0:*                               16222/ntpd          
udp        0      0 127.0.0.1:123               0.0.0.0:*                               16222/ntpd          
udp        0      0 0.0.0.0:123                 0.0.0.0:*                               16222/ntpd          
udp        0      0 fe80::204:23ff:fee7:123     :::*                                    16222/ntpd          
udp        0      0 fe80::204:23ff:fee7:123     :::*                                    16222/ntpd          
udp        0      0 fe80::204:23ff:fee7:123     :::*                                    16222/ntpd          
udp        0      0 fe80::204:23ff:fee7:123     :::*                                    16222/ntpd          
udp        0      0 fe80::204:23ff:fee7:123     :::*                                    16222/ntpd          
udp        0      0 fe80::215:17ff:feb4:123     :::*                                    16222/ntpd          
udp        0      0 fe80::215:17ff:feb4:123     :::*                                    16222/ntpd          
udp        0      0 ::1:123                     :::*                                    16222/ntpd          
udp        0      0 :::123                      :::*                                    16222/ntpd          

[root@ntp1 etc]# /usr/sbin/ntpd -g -p /var/run/ntpd.pid -l /tmp/ntp.log
[root@ntp1 etc]# cat /tmp/ntp.log
 9 Jul 15:33:37 ntpd[9651]: logging to file /tmp/ntp.log
 9 Jul 15:33:37 ntpd[9651]: precision = 1.000 usec
 9 Jul 15:33:37 ntpd[9651]: ntp_io: estimated max descriptors: 8192, initial socket boundary: 16
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 2, port 123, addr 0.0.0.0, in_classd=0 flags=9 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 0, addr ::, in6_is_addr_multicast=0 flags=1 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 0, addr ::1, in6_is_addr_multicast=0 flags=1 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 8, addr fe80::215:17ff:feb4:5ff8, in6_is_addr_multicast=0 flags=1 fails: Cannot assign requested address
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 6, addr fe80::215:17ff:feb4:5ff8, in6_is_addr_multicast=0 flags=1 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 4, addr fe80::215:17ff:feb4:5ff8, in6_is_addr_multicast=0 flags=1 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 9, addr fe80::204:23ff:fee7:b2fd, in6_is_addr_multicast=0 flags=1 fails: Cannot assign requested address
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 7, addr fe80::204:23ff:fee7:b2fd, in6_is_addr_multicast=0 flags=1 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 3, addr fe80::204:23ff:fee7:b2fd, in6_is_addr_multicast=0 flags=1 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 10, addr fe80::204:23ff:fee7:b2fc, in6_is_addr_multicast=0 flags=1 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 5, addr fe80::204:23ff:fee7:b2fc, in6_is_addr_multicast=0 flags=1 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 10, port 123, scope 2, addr fe80::204:23ff:fee7:b2fc, in6_is_addr_multicast=0 flags=1 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 2, port 123, addr 127.0.0.1, in_classd=0 flags=5 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 2, port 123, addr 172.17.201.6, in_classd=0 flags=25 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 2, port 123, addr 172.17.201.8, in_classd=0 flags=25 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 2, port 123, addr 172.22.1.152, in_classd=0 flags=25 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 2, port 123, addr 172.22.1.154, in_classd=0 flags=25 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: bind() fd 16, family 2, port 123, addr 192.168.1.1, in_classd=0 flags=25 fails: Address already in use
 9 Jul 15:33:37 ntpd[9651]: kernel time sync status 0040
[root@ntp1 etc]#

someone can maybe help me out here ?

10x

zirias · 07-09-2010, 04:50 PM

Hi,
I had various problems with ntpd, on an irregular basis. It worked most of the time, then it broke for no apparent reason (at least, I couldn't find it).

I switched to chrony that proved to be much more reliable for me, no problems so far. So maybe this could be an option for you, too.

NdAd · 07-09-2010, 04:58 PM

Quote:

Originally Posted by zirias

Hi,
I had various problems with ntpd, on an irregular basis. It worked most of the time, then it broke for no apparent reason (at least, I couldn't find it).

I switched to chrony that proved to be much more reliable for me, no problems so far. So maybe this could be an option for you, too.

hi zirias,
for me its not an option to use chrony. besides this issue ntpd working properly for me. so I rather solve this issue.
10x anyway

michaelk · 07-09-2010, 06:32 PM

Is the configuration file you posted a client's or ntp2's?

Quote:

*ntp2 LOCAL(0) 10 u 227 256 377 0.157 2.459 0.813

server ntp2
fudge 127.127.1.0 stratum 10

Indicates that ntp is actually synced to the computers local clock. The fudge line allows ntp to fallback and use the computers local clock in case you lose the internet or whatever you are using to sync time.

Quote:

#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

Without seeing the ntp.confs from both servers I might guess that you have not allowed incoming connections. Uncomment the line above and modify it to match your network address range. If your servers are are running a firewall you will need to allow port 123 UDP traffic. Be sure to restart ntp.

NdAd · 07-09-2010, 06:53 PM

Quote:

Originally Posted by michaelk

Is the configuration file you posted a client's or ntp2's?

Indicates that ntp is actually synced to the computers local clock. The fudge line allows ntp to fallback and use the computers local clock in case you lose the internet or whatever you are using to sync time.

Without seeing the ntp.confs from both servers I might guess that you have not allowed incoming connections. Uncomment the line above and modify it to match your network address range. If your servers are are running a firewall you will need to allow port 123 UDP traffic. Be sure to restart ntp.

Hi michaelk
The conf file above is from the client.
As for the restrict line, Im not sure thats the prob since i am using the same conf file both servers and the other one(ntp2) can accept incoming queries and works just fine, so im doubt that will help but i will try anyway at monday. and btw, no fw behind these servers

michaelk · 07-09-2010, 10:15 PM

I am far from being an expert with ntp. However, since you have confirmed that the configuration files are all the same then my assumptions are correct. ntp2 only appears to be working since it references the local clock on all the computers. With out uncommenting the restrict line quoted in my other post your servers will not be able to accept connections from clients and the reason you can not connect to ntp1.

Should be:

Quote:

server ntp1
server ntp2

server 127.127.1.0 # local clock
fudge 127.127.1.0 stratum 12

michaelk · 07-10-2010, 04:51 PM

Is this a standalone network? If not then you should sync the servers to some known time source.

As another test stop the ntp service on a client and run the ntpdate command using ntp2. If the command completes without finding a suitable server then ntp2 is not working.

NdAd · 07-12-2010, 04:24 PM

Quote:

Originally Posted by michaelk

Is this a standalone network? If not then you should sync the servers to some known time source.

As another test stop the ntp service on a client and run the ntpdate command using ntp2. If the command completes without finding a suitable server then ntp2 is not working.

hi again...
the network is S/A indeed. not internet connectivity.
today I made the change you recommanded about restrict line in both ntp servers :

Code:

restrict 172.17.201.0 mask 255.255.255.192 nomodify notrap
restrict 172.17.200.0 mask 255.255.255.0 nomodify notrap

and now it seems like we progressed BUT... after a while I gettin now at the clients falsetick mark, look at the huge offset ! why is that ?!:

Code:

[root@host1 ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
xntp1            LOCAL(0)        10 u   49   64  377    0.109   29.570   2.526
xntp2            LOCAL(0)        10 u   51   64  377    0.179  -4775.8   0.412

later I reloaded the service and try to sync it with ntpdate command:

Code:

[root@host1 ~]# ntpdate -b ntp2
12 Jul 13:46:49 ntpdate[15751]: step time server 172.17.201.5 offset -4.777314 sec

but still something is wrong when reach to full sync :

Code:

[root@host1 ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
xntp1            LOCAL(0)        10 u   45   64  377    0.122  4902.16   2.512
xntp2            LOCAL(0)        10 u   12   64  377    0.128   -9.852   0.655

michaelk · 07-12-2010, 04:49 PM

I might of confused you a bit. The servers should have these setting too. Changing stratum 10 to 2 is necessary so the clients will sync to the servers.

server 127.127.0.1
fudge 127.127.0.1 stratum 2

Adding the following line to each server will sync them together.
peer ntp2 (to sync ntp1 to ntp2, use ntp1 on ntp2)

Did you change the clients as suggests in post #6?

NdAd · 07-12-2010, 05:39 PM

Quote:

Originally Posted by michaelk

I might of confused you a bit. The servers should have these setting too. Changing stratum 10 to 2 is necessary so the clients will sync to the servers.

server 127.127.0.1
fudge 127.127.0.1 stratum 2

Adding the following line to each server will sync them together.
peer ntp2 (to sync ntp1 to ntp2, use ntp1 on ntp2)

Did you change the clients as suggests in post #6?

i did the change in post#6 . now the clients configured with stratum 12
and the servers with stratum 2. but still after a while im getting same result :

Code:

[root@host1 ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
xntp1            LOCAL(0)         3 u   51   64  377    0.133  4987.49   3.742
xntp2            LOCAL(0)         3 u   63   64  377    0.124   -2.982   0.550

michaelk · 07-12-2010, 07:15 PM

Post your ntp.conf files for the servers and clients. Maybe I have missed something.

Quote:

remote refid st t when poll reach delay offset jitter
==============================================================================
*LOCAL(0) .LOCL. 2 l 33 64 377 0.000 0.000 0.001

My server as a stand alone configured as described above.

Quote:

remote refid st t when poll reach delay offset jitter
==============================================================================
*server LOCAL(0) 3 u 20 64 377 0.930 1.817 1.609

My laptop time synced to the server.

NdAd · 07-13-2010, 11:55 AM

Quote:

Originally Posted by michaelk

Post your ntp.conf files for the servers and clients. Maybe I have missed something.

My server as a stand alone configured as described above.

My laptop time synced to the server.

very strange... should be very simple , right ?
btw, my ntp servers and my clients are in different subnets.
172.17.200.x for the clients and my servers are in 172.17.201.x
anyway, my client's ntp.conf :

Code:

 Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
#restrict default kod nomodify notrap nopeer noquery
#restrict -6 default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1 
restrict -6 ::1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
restrict 172.17.200.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).

#broadcast 192.168.1.255 key 42         # broadcast server
#broadcastclient                        # broadcast client
#broadcast 224.0.1.1 key 42             # multicast server
#multicastclient 224.0.1.1              # multicast client
#manycastserver 239.255.254.254         # manycast server
#manycastclient 239.255.254.254 key 42  # manycast client

# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available. 
server  ntp1
server  ntp2
fudge   127.127.1.0 stratum 12

# Drift file.  Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
driftfile /var/lib/ntp/drift

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography. 
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

my server's ntp.conf :

Code:

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
#restrict default kod nomodify notrap nopeer noquery
#restrict -6 default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
#restrict 127.0.0.1 
#restrict -6 ::1

# Hosts on local network are less restricted.
#restrict 172.17.201.0 mask 255.255.255.192 nomodify notrap
restrict 172.17.200.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.rhel.pool.ntp.org
#server 1.rhel.pool.ntp.org
#server 2.rhel.pool.ntp.org

#broadcast 192.168.1.255 key 42         # broadcast server
#broadcastclient                        # broadcast client
#broadcast 224.0.1.1 key 42             # multicast server
#multicastclient 224.0.1.1              # multicast client
#manycastserver 239.255.254.254         # manycast server
#manycastclient 239.255.254.254 key 42  # manycast client

# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available. 
server  127.127.1.0     # local clock
fudge   127.127.1.0 stratum 2

# Drift file.  Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
driftfile /var/lib/ntp/drift

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography. 
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

both ntp servers conf files are identical.

michaelk · 07-13-2010, 03:25 PM

Quote:

fudge 127.127.1.0 stratum 12

Delete this from your client configuration file.

Quote:

restrict 172.17.200.0 mask 255.255.255.0 nomodify notrap

Also comment this out of your client configuration file. Not required for clients.

And since you are on a standalone network try

Quote:

restrict default kod nomodify notrap nopeer

Instead of the current restriction. This should all computer on your network access.

NdAd · 07-13-2010, 05:32 PM

Quote:

Originally Posted by michaelk

Delete this from your client configuration file.

Also comment this out of your client configuration file. Not required for clients.

And since you are on a standalone network try

Instead of the current restriction. This should all computer on your network access.

well, i deleted the fudge line from clients conf file, and used your restrict line instead of my old one. now i'm gettin this output from client :

Code:

[root@host1 ~]# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 ntp1            .STEP.          16 u    - 1024    0    0.000    0.000   0.000
*ntp2            LOCAL(0)         3 u  106  128  377    0.176   -0.322   0.129

still, like something missing here...can't figure out whats wrong with my ntp1 server. how comes my host cannot reach only to ntp1.what else can u think of ?

michaelk · 07-13-2010, 09:39 PM

It appears that the client is communicating with ntp1. The poll time is 1024 seconds so it will take awhile to get anywhere.
I believe that the ntp1 time difference is greater then ntp2. Do you really need two time servers. If so you might want to try setting them up as peers or syncing ntp2 to ntp1.