Time Synschronization

[Mohamed Abdelfattah]

I have three servers in my environment.
2 working as cluster and one stand alone but in the same network with the cluster.
I need to synchronize the time on these servers. Should i used a time server or there an integrated time synch features on HP-UX v 11.1i.
Also the remote clients, can they use the time server on the system if it is exist and if not what is the best solution.

Regards
M.Abdelfattah

[Steven E. Protter]

Shalom,

Few issues come to mind.

1) Most firewalls block ntp protocol, port 123 which is the standard for keeping time on unix/linux systems. If this port is open, you need only configure /etc/ntp.conf and point it to valid time servers and insure the service xtntpd is running /sbin/init.d/xntpd start . vi the same file /etc/rc.config.d/ to make sure the service runs at startup.

2) Valid external time servers can be found at http://www.ntp.org There is also a windows client available there.

3) With one valid time server inside your network, all other hosts can point to it in their ntp.conf configuration. Windows hosts can use it as well.

4) Not that in a clustered configuration ntp does not listen on the cluster floagin ip under Linux Red Hat Clustering.

5) The ability of remote clients to use this client depends on your vpn/firewall configuration and what protocols are permitted. In general, most firewall block this protocol because there is a fear it can be abused.

SEP

[Bill Hassell]

Talk with your network administrator to get port 123 unblocked, or to change your firewall to use NTP to synce to several open Internet sites (the NTP pool is a good choice), then the firewall can be your NTP for all internal machines. HP-UX does have NTP integrated as a time sync service, but you need several NTP sources. To see if the service is blocked or open, do this:

ntpq -p pool.ntp.org

If you see several lines of server names, NTP is available to your system(s). Edit your /etc/ntp.conf file to remove all the comments (a copy of the original file is kept in /usr/newconfig/etc) and just put these lines in:

server 0.us.pool.ntp.org # US pool 0
server 1.us.pool.ntp.org # US pool 1
server 2.us.pool.ntp.org # US pool 2
fudge 127.127.1.1 stratum 10 # localhost fallback
driftfile /etc/ntp.drift # monitor drift

The us.pool set of servers can be changed to something close to your location -- see http://www.pool.ntp.org/

Then to start NTP sync services, first check that the current time is within 10 minutes of the correct time. If not, you may have to wait until the next reboot if you can't shutdown your applications. Changing the time of day, especially backwards, is not tolerated well by some applications. If the time is off between 3 and 10 minutes, use the ntpdate command like this:

ntpdate -B pool.ntp.org

This will slowly adjust the time (about 3 hours for an 8 minute error). After the time is within a couple of minutes, manually start xntpd:

xntpd

Then check /var/adm/syslog/syslog.log for any NTP errors. If all is well, the last step is to add NTP to the reboot startup. Edit the file /etc/rc.config.d/netdaemons and change these two lines:

export NTPDATE_SERVER=pool.ntp.org
export XNTPD=1

And that's it. Time will be maintained within 128ms accuracy. Repeat for other HP-UX servers. It's a good idea to have all your machines (PCs, network applicances, other Unix systems, UPS systems) all use NTP.

[Tom Brown]

Running HP-UX ntp daemons on a mixed-platform IP network over which you have no control can be complex and (emotionally) painful.

An alternative would be to put something in the root crontab like:
01 * * * * /usr/sbin/ntpdate -B time.nist.gov

This appears to work very well for us, and also works on multiple flavors of *nix, not just HP-UX.

man ntpdate for more details; as noted there, your mileage will vary.

[Bill Hassell]

Tom wrote:

> Running HP-UX ntp daemons on a mixed-platform IP network over which you have no control can be complex and (emotionally) painful.

That has not been my experience. NTP is a very stable and very mature protocol. Note that NTP is not the same as SNTP (used on Microsoft platforms). NTP is not only mature and secure (one security report in the last 20 years if I remember correctly).

> An alternative would be to put something in the root crontab like:
01 * * * * /usr/sbin/ntpdate -B time.nist.gov
>
> This appears to work very well for us, and also works on multiple flavors of *nix, not just HP-UX.

Although this is better than a simple ntpdate , it still doesn't insure NTP accuracy. xntpd has been available for all Unices for a long time and is designed to accurately maintain sync using multiple servers. Using time.nist.gov as the only source (especially for a bunch of machines in a data center) also disables the algorithms in NTP that calculate accuracy based on complex equations and if this source disappears (or becomes a restricted server), your machines have no backup. Using xntpd with at least 3-5 sources, specifically the NTP pool sources, will not only keep the accuracy and reliability but also spread the load across many, many time servers.