NTP Works Fine,But I cannot see it in PS NTP

[Prem Mohan]

Hi john,

> typ NTP00AC3D.;1
smst21 3 4 6 10 0 0 0 *
smst22 3 4 6 10 0 0 0 *
>
smst21, smst22 are the entries in the file SYS$SPECIFIC:[TCPIP$NTP]TCPIP$NTP.CONF

Prem

[Prem Mohan]

Hi John/Volker ,

Maybe this completely unrelated while I was trying to telnet to the NTP server from the non-showing node, I get this error

> telnet 1xx.xx.xx.xxx
%TELNET-E-IVHOST, Invalid or unknown host 1xx.xx.xx.xxx
-TCPIP-W-EAI_AGAIN, temporary failure
>

But the error is not observed from the showing node.

Prem

[John Abbott_2]

Prem,

Can you double check

1. UAF TCPIP$NTP has # full access # network login.

2. Is SYS$SPECIFIC:[TCPIP$NTP]LOGIN.COM; empty or just contain comments ?

Did you find anything in the accounting file ? ($ acc/full/sin/user=tcpip$ntp)

Any security or OPCOM alarms ?

J.

[John Abbott_2]

Prem, sorry mis read an early post - from your output the NTP service has no Log Options define nor a log file;

To correct run @tcpip$config
3 - server
12 - ntp
3 - stop & disable
12 - ntp
2 - enable & start
exit

$ tcpip sho service ntp/full

Check there are entries against lines;

Log Opts:
File: sys$specific:[tcpip$ntp]tcpip$ntp_run.log

Next check there is a log file and type it up...

J.

[John Abbott_2]

Not sure what happened to my last post, but the log opts line should have read

Log Opts: Acpt Actv Dactv Conn Error Exit Logi Logo Mdfy Rjct TimO Addr

Doing this will give us a log file to further investigate.

[Volker Halle]

Prem,

%TELNET-E-IVHOST, Invalid or unknown host 1xx.xx.xx.xxx
-TCPIP-W-EAI_AGAIN, temporary failure

seems to be a known issue with TCPIP V5.4 ECO 6 - see

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1057983

Volker.

[Prem Mohan]

> @sys$manager:tcpip$config.com

TCP/IP Network Configuration Procedure

This procedure helps you define the parameters required
to run HP TCP/IP Services for OpenVMS on this system.


Checking TCP/IP Services for OpenVMS configuration database files.



HP TCP/IP Services for OpenVMS Configuration Menu

Configuration options:

1 - Core environment
2 - Client components
3 - Server components
4 - Optional components

5 - Shutdown HP TCP/IP Services for OpenVMS
6 - Startup HP TCP/IP Services for OpenVMS
7 - Run tests

A - Configure options 1 - 4
[E] - Exit configuration procedure

Enter configuration option: 3






HP TCP/IP Services for OpenVMS Server Components Configuration Menu

Configuration options:

1 - BIND Disabled Stopped 12 - NTP Enabled Started
2 - BOOTP Disabled Stopped 13 - PC-NFS Disabled Stopped
3 - DHCP Disabled Stopped 14 - POP Disabled Stopped
4 - FINGER Disabled Stopped 15 - PORTMAPPER Disabled Stopped
5 - FTP Enabled Started 16 - RLOGIN Enabled Started
6 - IMAP Disabled Stopped 17 - RMT Disabled Stopped
7 - LBROKER Disabled Stopped 18 - SNMP Enabled Started
8 - LPR/LPD Disabled Stopped 19 - SSH Disabled Stopped
9 - METRIC Disabled Stopped 20 - TELNET Enabled Started
10 - NFS Disabled Stopped 21 - TFTP Disabled Stopped
11 - LOCKD/STATD Disabled Stopped 22 - XDM Disabled Stopped


A - Configure options 1 - 22
[E] - Exit menu

Enter configuration option: 12



NTP Configuration

Service is defined in the SYSUAF.
Service is defined in the TCPIP$SERVICE database.
Service is enabled on specific node.
Service is started.

NTP configuration options:

1 - Disable service on this node

2 - Stop service on this node
3 - Disable & Stop service on this node

[E] - Exit NTP configuration

Enter configuration option: 3
%TCPIP-I-INFO, service disabled
%TCPIP-I-INFO, process TCPIP$NT_BG3595 (pid=0000AC94) stopped
%TCPIP-I-INFO, logical names deleted
%TCPIP-I-INFO, image SYS$SYSTEM:TCPIP$NTP.EXE deinstalled
%TCPIP-S-SHUTDONE, TCPIP$NTP shutdown completed
Press Return to continue ...


HP TCP/IP Services for OpenVMS Server Components Configuration Menu

Configuration options:

1 - BIND Disabled Stopped 12 - NTP Disabled Stopped
2 - BOOTP Disabled Stopped 13 - PC-NFS Disabled Stopped
3 - DHCP Disabled Stopped 14 - POP Disabled Stopped
4 - FINGER Disabled Stopped 15 - PORTMAPPER Disabled Stopped
5 - FTP Enabled Started 16 - RLOGIN Enabled Started
6 - IMAP Disabled Stopped 17 - RMT Disabled Stopped
7 - LBROKER Disabled Stopped 18 - SNMP Enabled Started
8 - LPR/LPD Disabled Stopped 19 - SSH Disabled Stopped
9 - METRIC Disabled Stopped 20 - TELNET Enabled Started
10 - NFS Disabled Stopped 21 - TFTP Disabled Stopped
11 - LOCKD/STATD Disabled Stopped 22 - XDM Disabled Stopped


A - Configure options 1 - 22
[E] - Exit menu

Enter configuration option: 12



NTP Configuration

Service is defined in the SYSUAF.
Service is defined in the TCPIP$SERVICE database.
Service is not enabled.
Service is stopped.

NTP configuration options:

1 - Enable service on this node

2 - Enable & Start service on this node

[E] - Exit NTP configuration

Enter configuration option: 2
%TCPIP-I-INFO, image SYS$SYSTEM:TCPIP$NTP.EXE installed
%TCPIP-I-INFO, logical names created
%TCPIP-I-INFO, service enabled
%TCPIP-S-STARTDONE, TCPIP$NTP startup completed
Press Return to continue ...



HP TCP/IP Services for OpenVMS Server Components Configuration Menu

Configuration options:

1 - BIND Disabled Stopped 12 - NTP Enabled Started
2 - BOOTP Disabled Stopped 13 - PC-NFS Disabled Stopped
3 - DHCP Disabled Stopped 14 - POP Disabled Stopped
4 - FINGER Disabled Stopped 15 - PORTMAPPER Disabled Stopped
5 - FTP Enabled Started 16 - RLOGIN Enabled Started
6 - IMAP Disabled Stopped 17 - RMT Disabled Stopped
7 - LBROKER Disabled Stopped 18 - SNMP Enabled Started
8 - LPR/LPD Disabled Stopped 19 - SSH Disabled Stopped
9 - METRIC Disabled Stopped 20 - TELNET Enabled Started
10 - NFS Disabled Stopped 21 - TFTP Disabled Stopped
11 - LOCKD/STATD Disabled Stopped 22 - XDM Disabled Stopped


A - Configure options 1 - 22
[E] - Exit menu

Enter configuration option: E



HP TCP/IP Services for OpenVMS Configuration Menu

Configuration options:

1 - Core environment
2 - Client components
3 - Server components
4 - Optional components

5 - Shutdown HP TCP/IP Services for OpenVMS
6 - Startup HP TCP/IP Services for OpenVMS
7 - Run tests

A - Configure options 1 - 4
[E] - Exit configuration procedure

Enter configuration option: E

> sh def
SYS$SPECIFIC:[TCPIP$NTP]

> dir *ntp*.log

Directory SYS$SPECIFIC:[TCPIP$NTP]

TCPIP$NTP_RUN.LOG;2 TCPIP$NTP_RUN.LOG;1

Total of 2 files.
> dir *ntp*.log /size/date

Directory SYS$SPECIFIC:[TCPIP$NTP]

TCPIP$NTP_RUN.LOG;2
3 14-APR-2007 01:02:57.25
TCPIP$NTP_RUN.LOG;1
5 13-APR-2007 01:01:40.80

Total of 2 files, 8 blocks.

> typ TCPIP$NTP_RUN.LOG;
14 Apr 01:02:57 ntp[37201]: offset: 0.004126 sec freq: 23.534 ppm poll: 1024 sec error: 0.006063
14 Apr 02:02:59 ntp[37201]: offset: -0.001099 sec freq: 24.098 ppm poll: 1024 sec error: 0.005234
14 Apr 03:03:03 ntp[37201]: offset: -0.003948 sec freq: 23.038 ppm poll: 1024 sec error: 0.004259
14 Apr 04:03:05 ntp[37201]: offset: -0.001602 sec freq: 20.829 ppm poll: 1024 sec error: 0.004844
14 Apr 05:03:09 ntp[37201]: offset: 0.005427 sec freq: 21.770 ppm poll: 1024 sec error: 0.007446
14 Apr 06:03:12 ntp[37201]: offset: 0.005234 sec freq: 23.377 ppm poll: 1024 sec error: 0.006040
14 Apr 07:03:16 ntp[37201]: offset: -0.002263 sec freq: 24.223 ppm poll: 1024 sec error: 0.005926
14 Apr 08:03:19 ntp[37201]: offset: -0.010582 sec freq: 20.663 ppm poll: 1024 sec error: 0.008070
14 Apr 09:03:23 ntp[37201]: offset: -0.006563 sec freq: 19.861 ppm poll: 1024 sec error: 0.007806
14 Apr 10:03:26 ntp[37201]: offset: 0.002507 sec freq: 21.642 ppm poll: 1024 sec error: 0.012026
14 Apr 11:03:30 ntp[37201]: offset: 0.006951 sec freq: 24.006 ppm poll: 1024 sec error: 0.012642
14 Apr 12:03:33 ntp[37201]: offset: -0.002358 sec freq: 25.480 ppm poll: 1024 sec error: 0.011673
>....

As I said earlier I do not get anything, Until I do a ntpq and peers to syncronize the time.

Appreciate your help very much.

[Volker Halle]

Prem,

try this:

$ REPLY/ENABLE
$ SET audit/alarm/ena=process=creprc
$ @TCPIP$CONFIG

stop and start NTP

You should get 3 OPCOM messages:

Auditable event: Process created ($CREPRC)

INTERnet ACP Activate NTP Server

INTERnet ACP NOLISTEN Process creation success: Service - NTP

If you don't get them, there is already something wrong. Use $ TCPIP SHOW VERS/ALL and compare all relevant image versions. Rename the .CONF and .DRIFT file and try without them. Compare TCPIP$* logicals between the working and non-working system.

Disable process creation alarms with:
$ set audit/alarm/dis=process=creprc

Volker.

[Volker Halle]

Prem,

after re-defining NTP, dies TCPUP SHOW SERV NTP/FULL show:

File: sys$specific:[tcpip$ntp]tcpip$ntp_run.log

Volker.

[Prem Mohan]

Hi Volker

I still could not get the log file and also I could not see the OPCOM messages you conveyed.

There is one difference in the tcpip show version /all

in the working/showing node
TCPIP$IPC_SHR;2 V5.4-ECO7G 20-SEP-2006 SYS$COMMON:[SYSLIB]

in the working/non-showing node

TCPIP$IPC_SHR;1 V5.4-15F 25-APR-2006 SYS$COMMON:[SYSLIB]

will this have any difference ???


> REPLY/ENABLE
%%%%%%%%%%% OPCOM 15-APR-2007 14:27:58.35 %%%%%%%%%%%
Operator _XXXX24$RTA1: has been enabled, username SYSTEM

%%%%%%%%%%% OPCOM 15-APR-2007 14:27:58.35 %%%%%%%%%%%
Operator status for operator _SMST24$RTA1:
CENTRAL, PRINTER, TAPES, DISKS, DEVICES, CARDS, NETWORK, CLUSTER, SECURITY,
LICENSE, OPER1, OPER2, OPER3, OPER4, OPER5, OPER6, OPER7, OPER8, OPER9, OPER10,
OPER11, OPER12

> SET audit/alarm/ena=process=creprc
%%%%%%%%%%% OPCOM 15-APR-2007 14:28:13.47 %%%%%%%%%%%
Message from user AUDIT$SERVER on SMST24
Security alarm (SECURITY) and security audit (SECURITY) on XXXXX, system id: 63184
Auditable event: Security alarm state set
Event time: 15-APR-2007 14:28:13.47
PID: 0000B4FE
Username: SYSTEM
Alarm flags: ACL,AUTHORIZATION
BREAKIN: (DIALUP,LOCAL,REMOTE,NETWORK,DETACHED)
LOGFAIL: (BATCH,DIALUP,LOCAL,REMOTE,NETWORK,SUBPROCESS,
DETACHED)
PROCESS CONTROL: (CREPRC)
AUDIT: (ILLFORMED)


%%%%%%%%%%% OPCOM 15-APR-2007 14:28:31.13 %%%%%%%%%%%
Message from user AUDIT$SERVER on XXXXXX
Security alarm (SECURITY) on XXXXX, system id: 63184
Auditable event: Process created ($CREPRC)
Event time: 15-APR-2007 14:28:31.13
PID: 0000041C
Process name: TCPIP$FTP_1
Username: TCPIP$FTP
Process owner: [TCPIP$AUX,TCPIP$FTP]
Image name: $1$DKC0:[SYS0.SYSCOMMON.][SYSEXE]TCPIP$FTP_SERVER.EXE
New PID: 0000B4FF
New process name: TCPIP$FTPC064FD
New process owner: [SMSC]
New image name: SYS$SYSTEM:LOGINOUT.EXE
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)

ST24:SYSTEM>
%%%%%%%%%%% OPCOM 15-APR-2007 14:29:31.10 %%%%%%%%%%%
Message from user AUDIT$SERVER on XXXXX
Security alarm (SECURITY) on XXXX, system id: 63184
Auditable event: Process created ($CREPRC)
Event time: 15-APR-2007 14:29:31.10
PID: 0000041C
Process name: TCPIP$FTP_1
Username: TCPIP$FTP
Process owner: [TCPIP$AUX,TCPIP$FTP]
Image name: $1$DKC0:[SYS0.SYSCOMMON.][SYSEXE]TCPIP$FTP_SERVER.EXE
New PID: 0000B501
New process name: TCPIP$FTPC064FE
New process owner: [SMSC]
New image name: SYS$SYSTEM:LOGINOUT.EXE
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)


%%%%%%%%%%% OPCOM 15-APR-2007 14:30:37.19 %%%%%%%%%%%
Message from user AUDIT$SERVER on XXXXX
Security alarm (SECURITY) on XXXX, system id: 63184
Auditable event: Process created ($CREPRC)
Event time: 15-APR-2007 14:30:37.19
PID: 0000041C
Process name: TCPIP$FTP_1
Username: TCPIP$FTP
Process owner: [TCPIP$AUX,TCPIP$FTP]
Image name: $1$DKC0:[SYS0.SYSCOMMON.][SYSEXE]TCPIP$FTP_SERVER.EXE
New PID: 0000B502
New process name: TCPIP$FTPC064FF
New process owner: [SMSC]
New image name: SYS$SYSTEM:LOGINOUT.EXE
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)

%%%%%%%%%% OPCOM 15-APR-2007 14:31:39.95 %%%%%%%%%%%
Message from user AUDIT$SERVER on XXXXX
Security alarm (SECURITY) on XXXXX, system id: 63184
Auditable event: Process created ($CREPRC)
Event time: 15-APR-2007 14:31:39.94
PID: 0000041C
Process name: TCPIP$FTP_1
Username: TCPIP$FTP
Process owner: [TCPIP$AUX,TCPIP$FTP]
Image name: $1$DKC0:[SYS0.SYSCOMMON.][SYSEXE]TCPIP$FTP_SERVER.EXE
New PID: 0000B503
New process name: TCPIP$FTPC06500
New process owner: [SMSC]
New image name: SYS$SYSTEM:LOGINOUT.EXE
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)

>tcpip show version
%%%%%%%%%%% OPCOM 15-APR-2007 14:32:15.69 %%%%%%%%%%%
Message from user AUDIT$SERVER on XXXXX
Security alarm (SECURITY) on XXXXX, system id: 63184
Auditable event: Process created ($CREPRC)
Event time: 15-APR-2007 14:32:15.69
PID: 0000B4FE
Process name: SYSTEM
Username: SYSTEM
Process owner: [SYSTEM]
Terminal name: RTA1:
Image name: $1$DKC0:[SYS0.SYSCOMMON.][SYSEXE]TCPIP$UCP.EXE
New PID: 0000B504
New process name: SYSTEM_63654
New process owner: [SYSTEM]
New image name: SYS$SYSTEM:LOGINOUT
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)


HP TCP/IP Services for OpenVMS Alpha Version V5.4 - ECO 6
on a COMPAQ AlphaServer DS20E 666 MHz running OpenVMS V7.3-2

%%%%%%%%%%% OPCOM 15-APR-2007 14:32:33.18 %%%%%%%%%%%
Message from user AUDIT$SERVER on XXXXX
Security alarm (SECURITY) on XXXXXX, system id: 63184
Auditable event: Process created ($CREPRC)
Event time: 15-APR-2007 14:32:33.18
PID: 0000041C
Process name: TCPIP$FTP_1
Username: TCPIP$FTP
Process owner: [TCPIP$AUX,TCPIP$FTP]
Image name: $1$DKC0:[SYS0.SYSCOMMON.][SYSEXE]TCPIP$FTP_SERVER.EXE
New PID: 0000B505
New process name: TCPIP$FTPC06501
New process owner: [SMSC]
New image name: SYS$SYSTEM:LOGINOUT.EXE
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)

ST24:SYSTEM>
%%%%%%%%%%% OPCOM 15-APR-2007 14:33:33.84 %%%%%%%%%%%
Message from user AUDIT$SERVER on XXXXX
Security alarm (SECURITY) on XXXX, system id: 63184
Auditable event: Process created ($CREPRC)
Event time: 15-APR-2007 14:33:33.84
PID: 0000041C
Process name: TCPIP$FTP_1
Username: TCPIP$FTP
Process owner: [TCPIP$AUX,TCPIP$FTP]
Image name: $1$DKC0:[SYS0.SYSCOMMON.][SYSEXE]TCPIP$FTP_SERVER.EXE
New PID: 0000B506
New process name: TCPIP$FTPC06502
New process owner: [SMSC]
New image name: SYS$SYSTEM:LOGINOUT.EXE
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)

> set audit/alarm/dis=process=creprc
%%%%%%%%%%% OPCOM 15-APR-2007 14:34:08.66 %%%%%%%%%%%
Message from user AUDIT$SERVER on XXXXXX
Security alarm (SECURITY) and security audit (SECURITY) on XXXXX, system id: 63184
Auditable event: Security alarm state set
Event time: 15-APR-2007 14:34:08.65
PID: 0000B4FE
Username: SYSTEM
Alarm flags: ACL,AUTHORIZATION
BREAKIN: (DIALUP,LOCAL,REMOTE,NETWORK,DETACHED)
LOGFAIL: (BATCH,DIALUP,LOCAL,REMOTE,NETWORK,SUBPROCESS,
DETACHED)
AUDIT: (ILLFORMED)

[Hoff]

Is DECnet-Plus DECdts DTSS (or other time-base) enabled on the problematic node?

[Volker Halle]

Prem,

yes, the more recent TCPIP$IPC_SHR could have an effect on the non-working node. It's one of the 2 images provided as a solution for the TCPIP-W-EAI_AGAIN problem in TCPIP V5.4 ECO 6.

Once you've enabled CREPRC auditing, you need to issue the command: $ TCP DISABLE SERVICE NTP and $ TCPIP ENABLE SERVICE NTP to enable the NTP service. Only then should you see the 3 OPCOM messages shown.

I'm assuming, that the TCPIP$NTP_1 process get created, but fails and exits immediately. The reason for the failure may be shown in the 3rd OPCOM message. You may also see it with ACC/FULL/SINCE=start-time-of-NTP.

Consider to completely DISABLE NTP and also delete the TCPIP$NTP user and directory. Then configure it again. The msot important thing is to get a TCPIP$NTP_RUN.LOG file, so that you can 'see' the real error.

Volker.

[Volker Halle]

Prem,

to look at the command to set the NTP service log file, EDIT/read TCPIP$CONFIG.COM and search for 'TCPIP$NTP_RUN'. Then try this command to set the log file:

$ TCPIP SET SERV NTP/LOG=(FILE=SYS$SPECIFIC:[TCPIP$NTP]TCPIP$NTP_RUN.LOG,ALL)

Volker.

[Prem Mohan]

>
%%%%%%%%%%% OPCOM 16-APR-2007 14:56:19.04 %%%%%%%%%%%
Message from user AUDIT$SERVER on XXXXX
Security alarm (SECURITY) on XXXX, system id: 63184
Auditable event: Process created ($CREPRC)
Event time: 16-APR-2007 14:56:19.04
PID: 0000BE4E
Process name: TCPIP$NT_BG9458
Username: TCPIP$NTP
Process owner: [TCPIP$AUX,TCPIP$NTP]
Image name: $1$DKC0:[SYS0.SYSCOMMON.][SYSEXE]TCPIP$NTP.EXE
New PID: 0000BE4F
New process name: TCPIP$NTP_34160 <<<<<<<<< This is not seen
New process owner: [TCPIP$AUX,TCPIP$NTP]
New image name: SYS$SYSTEM:LOGINOUT
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)

Hi Volker,

How do I turn of the accounting (never had the need to that before ).

Even the above opcom messages appear only after I do the
$ntpq and later peers command.

ST24:SMSC> show system /net
OpenVMS V7.3-2 on node SMST24 16-APR-2007 15:07:53.87 Uptime 19 00:09:44
Pid Process Name State Pri I/O CPU Page flts Pages
0000041C TCPIP$FTP_1 LEF 9 3211499 0 00:02:33.43 743 308 N
0000B533 TCPIP$XDM_1 LEF 10 290 0 00:00:00.12 771 325 N
00002A05 TASK_14010005 HIB 6 759 0 00:00:00.14 682 270 N
0000BE4E TCPIP$NT_BG9458 <<< LEF 9 1946 0 00:00:00.12 746 325 N




> sh proc /id=be4e

16-APR-2007 15:16:46.98 User: TCPIP$NTP Process ID: 0000BE4E
Node: SMST24 Process name: "TCPIP$NT_BG9458"

Terminal:
User Identifier: [TCPIP$AUX,TCPIP$NTP]
Base priority: 8
Default file spec: Not available
Number of Kthreads: 1

Devices allocated: BG9469:
BG9470:
BG9471:
BG9472:
BG9478:

Soft CPU Affinity: off

There is no difference between the tcpip$config.com in the working/showing & working/non-showing nodes.

Best regards
Prem.

[Prem Mohan]

I still could not get the TCPIP$NTP_RUN.LOG

[Volker Halle]

Prem,

the TCPIP$NTP_1 process should be started automatically, when you issue the TCPIP ENABLE SERVICE NTP command. You should see the CREPRC audit alarm at that time.

Did you completely disable and delete NTP including the TCPIP$NTP account ?

You can turn on image accounting with

$ SET ACC/ENABLE=IMAGE

You look at the accouting records with:

$ ACC/FULL/SINCE=date-and-time

Volker.

PS: I'm a the DECUS IT Symposium in Nuernberg this week, so I may not have a lot of time to answer your questions. Please be patient.

[Prem Mohan]

Hi volker,
I used the tcpip$config to disable and stop and enable and start the NTP.

I did see the audting alarm which I posted earlier

%%%%%%%%%%% OPCOM 16-APR-2007 14:56:19.04 %%%%%%%%%%%
Message from user AUDIT$SERVER on XXXXX
Security alarm (SECURITY) on XXXX, system id: 63184
Auditable event: Process created ($CREPRC)
Event time: 16-APR-2007 14:56:19.04
PID: 0000BE4E
Process name: TCPIP$NT_BG9458
Username: TCPIP$NTP
Process owner: [TCPIP$AUX,TCPIP$NTP]
Image name: $1$DKC0:[SYS0.SYSCOMMON.][SYSEXE]TCPIP$NTP.EXE
New PID: 0000BE4F
New process name: TCPIP$NTP_34160 <<<<<<<<< This is not seen
New process owner: [TCPIP$AUX,TCPIP$NTP]
New image name: SYS$SYSTEM:LOGINOUT
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)

I did not disable the TCPIP$NTP account.I will try that and let you know.
I was pulled for something else.

Best Regards
Prem.

[Volker Halle]

Prem,

when you TCPIP ENABLE SERVICE NTP, you should see a CREPRC audit alarm. TCPIP$NETACP should be creating the TCPIP$NTP_1 process. That's how it's supposed to happen.

Volker.