NTP Server

[John Jimenez]

This new servers clock runs really slow. One of my books explains how to set it up. It looks pretty simple. but show's 3 different ways
1) Modify it to use Server Polling. (Modify the ntp.conf file
Server gama
driftfile /var/adm/ntp.drift
2) Configure it to use Server Broadcast
droadcastclient yes
driftfile /var/adm/ntp.drift
3) use ntpdate command with multiple servers
ntpdate ben.cs.wisc.edu bigben.cac.washington.edu

Is anyone better then another? The web site suggested I use a Public NTP Secondary (stratum 2) Time Servers, so I have notified one.

[Elmar P. Kolkman · Accepted solution]

Setting up ntp.conf to use multiple servers (probably public, but internal servers is also possible if you have good clocks on other servers) is good enough. After that, make sure xntpd is started and your clock should be synchronised as long as your initial time is not too much off.
To synchronise the clock if xntpd doesn't start because of a too large offset, you can use ntpdate to synchronise it. Using -B will force slew, resulting in a slowly synchronising clock, allowing processes to keep running correctly, but this can take a long time. If you omit the -B, it will instantly synchronise the clock, but this can result in problems with time-dependent processes, so be carefull running this in multi-user mode !!!

[John Jimenez]

Hmmm, I will try to find out if we have any time dependant processes. But maybe I only need to run ntpdate once a week out of cron on a weekend. this should be pretty safe and keep me pretty close. I just tried it manually on 1 server and it worked great.

[Steven E. Protter]

Any public source, military or university will get yu good time.

I think item 2 will work best and limit your servers exposure to the net.

The adjustment process if the clock is off is not instant. If the clock is running ahead of time, it will run slowly, sometimes for hours until it synchs up. Same thing on the other side, just it will run faster.

We have a single server exposed to the Internet which provides time to all internal servers. It doesn't broadcast, the servers connect and request time. That scenario works well for us.

SEP

[John Jimenez]

Steven, You mentioned that you have one server exposed to the internet. We Have 1 HP-Unix server, and will soon have our previous older box (future disaster recovery system) upgraded to 11i which will be at a remote site, connected via a T1 connection. everything else is Windows. Is there any security issues with these servers broadcasting all the time? or would I be safer sticking with synchronizing the clocks once a week, late on a Sunday night.

[Mark Greene_1]

you can also use the -a option of the date command to slowly slew the clock to the correct time. Starting this on a Friday night and letting it go over the weekend when there is (presumably) less activity on the system has worked for me in the past.

HTH
mark

[Bill Thorsteinson]

I use my ISPs NDS servers which also serve as NTP servers. I through in a level 2 or 3 public server from a nearby public server. Routes are to three different atomic clocks. This allows differences to be decided on a two of three votes manner as suggested by NTP documentation.

As you have one server exposted to the net this server can be your primary server (level 3 or 4).

As a fallback you may want to configure the clocks on three servers with good clocks as sources at level 7 or 10. Peer these servers.

Have these servers use the net connected server as their server. All you clients can connect to the three servers above. If you want broadcast, set 1 client per subnet to act as a broadcast server.

Using these servers each client should drop to three UDP round trips per hour to each of ther servers.

If the clock on the problem is really bad its ntp client will likely step the clock about 1/8th of a second every so often.

[Tom Danzig]

Here's a link to a web listing of public Stratum 1 time servers.

http://www.eecis.udel.edu/~mills/ntp/clock1a.html

Be sure to reference the terms of use policy. You can use any of the servers listed as "open access" w/o having to contact anyone for permission.

[Alzhy]

If you will have an Internet facing primary NTP server that will also be synchng up from public sources -- just be sure it will have mutliple sources and ensure that you're synching from "reliable" sources.

Nowadays though, NTP serving in most large corporates are performed by the routers/switches.. CISCO's have NTP services. So my NTP server is always my default router..

[Mark Greene_1]

John,

Were you able to resolve this? Just curious.


mark

[John Jimenez]

Yes, Sorry I was out part of last week on vacation. I will review all your procedures, so far they all look really good, now I just have to decide which on to implement.....
Thanks again for your input...