ntpdate XXX works ; ntpdate -q XXX don't works

oudoubah · 12-08-2011, 10:58 AM

Hi,

I have a problem with my ntp service (on Centos 4) : the ntp stay synchronized on local, not on the reference.
After searching for 2 days on the web, i've not yet found the solution.

I tried to use ntpdate to query only the ntp server :

Code:

# /usr/sbin/ntpdate -q XX.XX.XX.XX
server XX.XX.XX.XX, stratum 0, offset 0.000000, delay 0.00000
 8 Dec 17:51:30 ntpdate[19016]: no server suitable for synchronization found

but i can cynchronize the clock :

Code:

# /usr/sbin/ntpdate XX.XX.XX.XX
 8 Dec 17:37:24 ntpdate[30430]: adjust time server XX.XX.XX.XX offset -0.029291 sec

When ntpd is running, ntpq -p tell me that the synchronisation is done on LOCAL(0) and not on XX.XX.XX.XX

ntp.conf :

Code:

restrict default nomodify notrap
server XX.XX.XX.XX prefer
server  127.127.1.0     # local clock
fudge   127.127.1.0 stratum 10
driftfile /var/lib/ntp/drift
broadcastdelay  0.008

Have you any solution, clue, idea?

Thanks,

lithos · 12-08-2011, 01:57 PM

what is your /etc/ntp.conf ?

This works for my servers:

Code:

cat /etc/ntp.conf 
# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1 nomodify

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

restrict 127.0.0.0 mask 255.0.0.0 nomodify nopeer notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).

server 0.centos.pool.ntp.org prefer
server 1.centos.pool.ntp.org burst iburst
server 2.centos.pool.ntp.org

#broadcast 192.168.1.255 key 42         # broadcast server
#broadcastclient                        # broadcast client
#broadcast 224.0.1.1 key 42             # multicast server
#multicastclient 224.0.1.1              # multicast client
#manycastserver 239.255.254.254         # manycast server
#manycastclient 239.255.254.254 key 42  # manycast client

# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available. 
server 127.127.1.0
fudge   127.127.1.0 stratum 10

# Drift file.  Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
driftfile /var/lib/ntp/drift

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography. 
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

good luck

michaelk · 12-09-2011, 07:38 AM

Shall we assume your time server is on your LAN since you have used xx.xx.xx.xx?
Post the output of ntpq -p of the client and also the ntp.conf from your timer server.

oudoubah · 12-09-2011, 09:23 AM

Yes, the time server is on the lan, but i don't have access on it.

remote refid st t when poll reach delay offset jitter
==============================================================================
XX.XX.XX.XX Y.Y.Y.Y 2 u 12 64 17 0.311 10.299 8.433
*LOCAL(0) LOCAL(0) 10 l - 64 377 0.000 0.000 0.001

The Y.Y.Y.Y is also on the lan, but i don't have network access on it.

I've done a new test with 2 servers and the reference clock :
the two servers can't ntpd with XX.XX.XX.XX, but ntpdate XX.XX.XX.XX works.

The servers are declared as peer in ntp.conf.
The first one stay synchronized to local
The second one is synchronized to the first one!

It means that ntpd is able to synchronize the server, but don't choose the "good one". Why?

lithos · 12-09-2011, 10:24 AM

NTPD service is running on port 123 UDP,
maybe you need to open the port in your IPTABLES if you have the firewall set-up?

Code:

-A INPUT -p udp -m udp --dport 123 -j ACCEPT 

-A OUTPUT -p udp -m udp --sport 123 -j ACCEPT

oudoubah · 12-12-2011, 07:28 AM

I've no firewall on this server.

ntpdate works, ntpq -p can tell me what is the refid of the XX.XX.XX.XX server is, so i think that it's not a network problem :-/