Some issues on NTP

[Ngoh Chean Siung]

Hi,

After I proposed my NTP plan to my superior, below are the questions that he would like to know first before the actual implementation of NTP.

1) The syncronization between NTP server and NTP client means that the NTP client own internal clock will exactly follow the NTP server's clock OR only whenever there is a transaction (insert, update & delete) occurs, the time will be refer to the NTP server.

2) If the NTP server is down, how about the NTP clients? Will they follow back their own internal clock automatically? Or need any commands to execute it? If the NTP server is up, will the NTP clients automatically update the NTP server clock?

3) From the proposal stated as below (Note:), it is recommended to leave xntpd running on the client but will increase network traffic. Am I right? So, we can stop the xntpd on client side by

Edit /etc/rc.config.d/netdaemons and set the following line as shown:
XNTPD=0

But, I need to execute the ntpdate command every 12 hours to ensure time syncronization.

Note: It is recommended to leave xntpd running on the client to gain the most exact syncronization however, some environments prefer to avoid the network traffic due to performance reasons. At a minimum, the ntpdate command should be run every 12 hours on the client via a cron job to ensure time syncronization.

4) Actually now I am quite confusing because there are 2 ways to configure NTP (either through command or SAM).

I have 2 situations that need to configure the NTP.

A) Within the company, NTP server is Pluto (IP-10.12.160.1) and NTP clients are Jupiter (IP-10.11.160.1) & Mercury (IP-10.11.160.2). For this situation, I plan to configure NTP through command but how to add the broadcast address since the NTP server and client is in different subnet? (I just have the steps to add broadcast address through SAM)

B) Through lease line. NTP server is Pluto (IP-10.12.160.1) and NTP clients is Saturn (IP - 132.147.10.2). For this situation, I plan to configure NTP through SAM but after add in the broadcast address, there will be broadcasts being sent to our network. Can we disable the broadcasts being send to our network?

If the NTP server and clients is in different, is it compulsory that I have to add in broadcast address? Any impact of the broadcast address?

Pls advise. Sorry for the long questions.

regards

[SureshKumar_2]

Hi

Plz find the suggestions, for ur questions.

1) NTP Client will exactly follow the NTP server's clock

2)U can always prefer for Backup time servers. In /etc/ntp.conf
---
server
server
-----
Backup time server u can always prefer for Internet Time servers. Primary should be atleast within your organisation, it will be better to update all clients as up to date.

3) Running this background daemon, doesnt going to affect our network traffic. Yes, if it is running xntpd, it will keep the exact stratum level, with the current time server.

4) Configure thru' commandline it is very easy.

a) Configure NTP serer,
i) /etc/rc.config.d/netdaemons
(Make xntpd=1
export NTPDATE_SERVER=
If u want this as its clock reference u can also give 127.127.1.1)
ii) /etc/ntp.conf
server=
iii) start the service,
/sbin/init.d/xntpd start
after 5/10 mts
verify by ntpq -p

b) Configure the NTP Client
i) /etc/ntp.conf
server=
ii) start the service,
/sbin/init.d/xntpd start
after 5/10 mts
verify by ntpq -p

Hope this will help you.

for further refer,

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90685/B2355-90685_top.html&con=/hpux/onlinedocs/B2355-90685/00/00/63-con.html&toc=/hpux/onlinedocs/B2355-90685/00/00/63-toc.html&searchterms=NTP&queryid=20011204-111728

suresh

[Ngoh Chean Siung]

Hi Suresh,

Thanks for your feedback.

1) I set the NTP backup server time source in /etc/ntp.conf. But, in NTP server or client?

2) Does my NTP server/client need to always connect to the internet in order to get the internet time source? Any internet time source for Malaysia?

3) Assume that there is no backup for NTP server time source. If the NTP server down, how about the NTP client's time?

regards.

[SureshKumar_2]

Hi

1) a) If u set only /etc/ntp.conf -> then it is client.
b) once u put it in, /etc/rc.config.d/netdaemons -> then it is server.

2) yes, it depends upon that statum level. for malasia, i recommend u to check thru' ping command to find out which time server is nearby you.
try this,
ntp-cup.external.hp.com
clock.cuhk.edu.hk -> HongKong.
jamtepat.singnet.com.sg
nets.org.sg
which ever comes less time, u can prefer that server. Hope this url will further help u for NTP servers locality..
http://www.eecis.udel.edu/~mills/ntp/clock1a.html


3) When the client refer once, it change its local clock time into the referred time source. if not available with NTP server, it will refer another source, what u can always put to refer local time as 127.127.1.1 (as in ntp.conf as last line)

ALL the best!

suresh

[Sanjay Kumar Suri]

Minor correction:

ntp.conf and netdaemons is configured in client as well as server. However in case of server following line in /etc/rc.config.d/netdaemons has blank entry for NTPDATE_SERVER

export NTPDATE_SERVER=

whereas in case of client it contains entry for NTP server.

sks

[Ngoh Chean Siung]

Hi,

Just need some extra confirmation.

If the NTP server down at 9:00am, (assumed that there is no NTP backup server)

a) Is the NTP client time also stop at 9:00am? (By key in command - date, the time is always 9:00am, right?)

b) When the NTP client time is stop, any impact to the NTP client?

c) If the NTP server up at 10:00am, will the NTP client automatically follow back the NTP server time which is 10:00am without required I manually to key in any commands?

regards

[Sanjay_6]

Hi,

Try this FAQ

http://www.ntp.org/ntpfaq/NTP-s-def.htm

More info from ntp.org.

http://www.ntp.org/

Hope this helps.

Regds

[SureshKumar_2]

Hi

a) The time will be set in client clock. and that will be continued.

b) client time will not be stoped, only the sync operation will be stopped, it may run with referred time+[errors]

c) Whenever sync operation started, it continued to sync with the operation. [ for this if u want to confirm, stop & start the service ] - If any errors found in client time will be changed to referred time on NTP server.

suresh

[Elmar P. Kolkman · Accepted solution]

I see some minor flaws in the answers given so far. So I will try to answer all questions asked so far.

First the primary questions.
1) The client will try to FOLLOW the servers clock, unless the difference between the two clocks is too large. If you adjust the time on the server, the clock on the client will not jump but will slowly adjust by altering the speed of the clock. If the time is more then about 20 minutes off, the client will not adjust. If you want it to adjust, you will have to manually adjust the client, for instance with the ntpdate command, and then restart the ntp daemon.

2) ntp works with the udp protocol. This means that clients know how to behave if a server is unreachable or if the answer doesn't come back in time. So, if the server is down, the client will not adjust the speed of its internal clock. But the client will run happily and will try to synchronise once the server is back online.

3) The network load of the ntp daemon is so low, I wouldn't do that. Mind that a lot of programs or even filesystems don't like timejumps. That's why there is a ntp daemon in the first place, altering the speed of the internal clock instead of just syncing. If you want to jump the clock every twelve hours with ntpdate, then there is no reason at all to use ntp, use rdate. If you want to lower the network load anyway, just alter the polling interval.

4) Don't do the broadcast thing. Define Pluto as a server (server 127.0.0.1) and the clients as clients of pluto (server 10.12.160.1). That way, you only need routers that let the ntp packets through between the networks, not the broadcasts.

Your second series of questions:
1) I set the NTP backup server time source in /etc/ntp.conf. But, in NTP server or client?

I don't understand this question.

2) Does my NTP server/client need to always connect to the internet in order to get the internet time source? Any internet time source for Malaysia?
I don't know if there are Malaysian NTP sources on the internet. Check out sites like ntp.org, I guess. Also, you only need to have your NTP server to sync to the internet. And to have it the right way, let it sync to its internal clock too. That prevents strange effects if the internet and its own clock are too much off.

3) Assume that there is no backup for NTP server time source. If the NTP server down, how about the NTP client's time?
This one is already answered above: the client will keep on running just fine.

The third set of questions are all answered already.

One more thing: mind that if you put a NTP server in the NTPDATE_SERVERS var, mentioned by Sanjay, it will sync the clock with that server every time you run the /sbin/init.d/xntpd script, which might not be what your want (see my response to primary question number 3).

Good luck.

[Bill Thorsteinson]

1) The NTP system only syncronizes the internal
clocks. It does not replace them. As noted
in some of the other replies if the clocks
differ too greatly, they will not syncronize.

2) If the NTP server is down the clients will continue allong find, but their clocks may drift apart. Consider setting up three servers
inside your organization. If your clients use all three, they can handle one server being down or sending the incorrect time.

3) NTP uses small UDP packets generally once every 15 minutes or so once the clocks are syncronized. This load is very low, especially compared to the overhead of something like windows which broadcasts a large messge on one or more protocols every 5 minutes.

4) For a configuratio such as your 1 server, 2 clients, I would peer the three of them, and configure them all to syncronize with an outside server. Don't use broadcast.

Your ISP's DNS server is likely running NTP,
if not they may have a time server.

ntp.org has a list of public servers arround the world. Pick one that is close by network time. Check the output of 'ntpq -c peers'
once you are configured.

Unless you lock down access all clients are servers. Other client can connect to them.
For this reason NTP has a stratum id which
counts how many servers from a time source
the server is. Generally the lower the better. A value from 3 to 6 is typical for a reasonable server.

A server without an external time service may
advertize its internal clock and claim to be
stratum 1.

NTP can also be connected to a GPS or radio clock to get a time signal. This is more
complicated than connecting to then network.

There is no requirment to add a broadcast
address. It can reduce the already low traffic if you have lots of clients on the
same subnet, but requires extra setup.
In your case it will increase the traffic slightly for no benefit.

If you configure the local clock as a source use the fudge parmater to raise to a stratum higher than your servers. I use stratum 10.

Peering your servers with the local clocks as as high stratum source will allow them to syncronize even if the network is disconnected for a long time.

[Ngoh Chean Siung]

Hi,

Thanks for all of ur valuable replies.

Actually my NTP setup plan is as below

Inside the company
==================
Pluto (10.12.160.1) is a NTP server.
Jupiter (10.11.160.1) is a NTP client.
Mercury (10.11.160.2) is a NTP client.

All these 3 servers above is located in a same area (connected through LAN).

Not inside the company
======================
Saturn (132.147.160.1) is a NTP client. (The communication between this server and Pluto server is through WAN and need to go thru router)

All our servers INFORMIX transaction's time (insert, update & delete) will be refer to the Pluto internal clock.

I am not using any external time source from internet because all these servers are NOT connected to internet.

1) Is the NTP configuration for Saturn exactly SAME as Jupiter & Mercury?

2) Even the NTP server and client are not in same subnet, it is not necessary to use broadcast address. Am I right?

3) The things that I can do to replace the way of using broadcast address is

At NTP server site (Pluto)
==========================
a) In /etc/rc.config.d/netdaemons file,
export NTPDATE_SERVER=
export XNTPD=1
export XNTPD_ARGS=

b) In /etc/ntp.conf file,
server 127.127.1.1
fudge 127.127.1.1 stratum=10

At NTP client site (Jupiter,Mercury & Saturn)
=============================================
a) In /etc/rc.config.d/netdaemons file,
export NTPDATE_SERVER=Pluto
export XNTPD=1
export XNTPD_ARGS=

b) In /etc/ntp.conf file,
server Pluto
driftfile /etc/ntp.drift

Above is only a part of the NTP configuration, what I want to confirm here is whether above configuration is used to replace the way of NOT using broadcast address. Am I right?

regards.

[SureshKumar_2]

Hi

1) NTP configuration is same for all NTP Clients as u mentioned.

2) Yes, u r right. It is not necessary to use broadcast address.

3) What ever u have mentioned is only the NTP configuration.

Broadcast Methods: Old methodologies used for Time syncronisation earlier, and also now it is not recommended.

Broadcaster - server provides the time for a particular Network/host.

Broadcast Client - Gets the time from the specified server.

Configuration: (Broadcast method) - Instead of server parameter u may need to replace as broadcast like below.
~~~~~~~~~~~~~~

On server side,
/etc/ntp.conf
broadcast

On client side,
/etc/ntp.conf
broadcastclient yes

For more info, on broadcast u can also have a look on this url:

http://docs.hp.com/hpux/onlinedocs/B2355-90685/B2355-90685.html

Hope these meets ur requirement

suresh

[Bill Thorsteinson]

Yes, this looks like a workable configuration.

The clocks will follow pluto and will drift
accordingly. If its clock drifts you will need
to configure a script to move its clock slowly.
Reset the time a second every two or three hours. For a larger adjustment restart the ntp clients and adjust every half hour or so.

If the clock drift a lot try using one of the clients as the server.

Consider connecting a GPS as a time source if
needed.

[Ngoh Chean Siung]

Hi,

Just want to know is there any commands to check the traffic on the server (to hv a comparison on the traffic before and after implementation of NTP)

regards.

[Bill Hassell]

NTP is the LOWEST overhead protocol that I know of. Here is what happens: when first started, xntpd will poll the server by sending 64 bytes (that's all) to the server and 64 bytes will be returned. Then every 64 seconds, another 64 bytes will be sent and received. This continues for a long time (several dozens minutes) until the connection has been characterized as far as delays and reliability. Then slowly (VERY slowly), your client clock will be adjusted to match the NTP server. But this is done in very small (millisecond) steps. Every day (using NTP properly), there will always be 86,400 seconds. If the client is too fast, then the clock will be adjusted so that every second is just a fraction longer.

For example, if your client is off by 5 minutes, it could take 2-4 hours to adjust the clock so that no seconds are lost. AS is true with all databases and many other application programs, you NEVER want to change the time while running. That's why the: export NTP_server= *must* be set to point to your server. This script is run at startup, prior to starting database and other programs, at a point where 'jumping' the date will not affect any programs.

Setting up ntp is very easy. The server has the ntp.conf file you've listed already. Leave the NTP_SERVER= line blank in /etc/rc.config.d/netdaemins, set XNTPD=1 and just start ntp on the server with: /sbin/init.d/xntpd start

After a minute or so, check /var/adm/syslog/syslog.d for any errors from xntpd. Note that there will normally be some status messages once in a while. You are looking for actual errors like socket already in use.

Then create the npt.conf file with just the server line (driftfile line is optional). Then see if your client can reach the server with ntpq -p pluto. If this works, you're all set. Just start ntp with: /sbin/inin.d/xntpd start, and as with the server, check syslog.log for errors.

And as far as Malaysia, *all* time in HP-UX as well as NTP is kept in Zulu (also known as GMT or UTC). The operating system always keeps time in GMT with no daylight saving changes. Then by using the TZ variable, your local users (and Informix) are given a translated time, so they 'see' Malaysia time.

The NTP protocol is very complex and designed to never allow the time to get out of control. It makes very small changes very slowly and if the server goes down, even for a few days, your client will be fine. Their internal clock will continue and may drift a few seconds every day, but once your server is back online, NTP will adjust the client clocks to within 128ms of pluto's clock.

[Ngoh Chean Siung]

Hi Bill,

Thanks for your great explanation of the NTP logic.

From your explanation, what I know is actually NTP will not increase any traffic or bad impact to either NTP server or client. Am I right?

There is a line that I not quite understand which is stated as below:

Every day (using NTP properly), there will always be 86,400 seconds.

May I know what do you mean for the above statement?

regards.

[Bill Hassell]

You will not be able to measure any change in network traffic at all. If you use telnet to logon to your server, and list the man page for awk, you will have used more network bandwidth than NTP will ever need for all your clients.

There are exactly 86,400 seconds in one day. However, if you change the time (by using the date command), you will create a 'step' change or a jump in the time kept by the computer. Most database programs can get very upset if two separate transactions were to have out of order timestamps. So every second must exist while these time-sensitive applications are running.

Note that there are some admins who were taught to run ntpdate every few hours. That is a BAD idea since it is a jump change of the time. If you go to the source for NTP: ntp.org, and specifically: http://www.ntp.org/ntpfaq/NTP-s-config.htm The proper way to use NTP is ntpdate for bootup and xntpd while running.

Now if the time is behind by 2 minutes, the temptation is to run date and change the time forward, but there will be a loss of 120 seconds that may occur right in the middle of database processing. Sometimes you are lucky and there will be no corruption, and sometimes not. What NTP does is to reduce the length of 1 second to perhaps 900ms and keep the clock running slightly faster until the time in the computer matches the server. Then the clock returns to 1 second = 1000ms.

This means that all 86,400 seconds will occur during a 24 hour period. By the way, this is exactly how the power company maintains accuracy of the 60Hz power cycles. During the day, the accuracy can vary widely, as much as 55 to 65Hz, but over a week's period, the frequency is averaged by the power company to match atomic time. And that's why your AC-powered clocks are accurate.

[Ngoh Chean Siung]

Hi Bill,

I telnet to the server and list the man page for "awk", but how I determine it is using more network bandwidth than NTP will ever need for all your clients? In which statement under the man "awk"?

regards.

[Bill Hassell]

Sorry about the incomplete example. When you read the man page for awk, it was about 25,000 bytes in length and with protocol overhead, probably 30,000 bytes total just to read that document in a few minutes. During that same time (let's say 5 minutes), NTP would have transmitted and received a total of 256 bytes at the very worst case (64 bytes out and back every 64 seconds). Once NTP has been running for a day or two, the poll interval slows from once every 64 seconds to once every 1024 seconds (17 minutes). Thus, the total daily traffic for a client is 10,800. That's less than half the traffic for your 5 minute awk man page.

The illustration is to show that NTP traffic is so small that it has no effect on your network at all.

[Ngoh Chean Siung]

Hi Bill,

1) How did you come out the calculation for the total dirty traffic for a client which is 10,800 (I guess this is 10,800 bytes, right)?

2) For a NORMAL NTP transmission, it is about 64 bytes out and back every 64 seconds. Am I right? That's mean

1 day is 24 hours which is 24*60*60=86400 seconds.

As back every 64 seconds, then 86400/64=1350 seconds.

Thus, total bytes per day for NTP transmit and receive is 1350*64=86400 bytes.

Is the above calculation correct?

regards.

[Bill Hassell]

86400 seconds divided by 1024 = 84 updates per day. I mentioned that on a stable network, NTP slows down polling intervals to a maximum of 1024 seconds (once every 17 minutes). So, 84 polls * 64 bytes per query * 2 (for query and reply) = 10,752 byes of traffic for a 23 hour period. If you have an unstable network with random delays, then NTP will poll as fast as it can, 64 bytes in and out every 64 seconds, and that translates to 172,800 bytes in 24 hours.

To put this trivial amount of data in perspective, NTP will at the most use 128 bytes every 64 seconds. On a 10 BaseT network, typical throughput is about 500 Kbytes/sec so in 64 seconds, 32 megabytes will zip by. So 173 Kbytes is nothing compared to 32 Mbytes.

[Ngoh Chean Siung]

Hi Bill,

Thanks for your reply.

How about this question?

1) How did you come out the calculation for the total dirty traffic for a client which is 10,800 (I guess this is 10,800 bytes, right)?

regards.

[Ngoh Chean Siung]

Hi Bill,

Now I understand how you come out the calculation after read through 3 times.

Thanks.

regards.

[Bill Hassell]

Sorry for the rounding...here are the eaxct numbers:

86,400 / 1024 = 84.375 NTP polls per day
84.375 * 128 = 10,800 bytes per day

Technically, only 84 polls will occur in 24 hours so the traffic is 10,752 (apx. 10,800)

[Ngoh Chean Siung]

Hi,

Let said now there is a NTP client which the OS is win2k. This client need to refer to the NTP server which is HP-UX.

1) Is the above situation posibble due to 2 different OS platforms?

2) If possible, what is the steps that need to be configured in this NTP client?

regards.