NTP: Timing is Everything

What’s the one thing that you see criminals, spies and other mysterious individuals doing just prior to embarking on a caper? If you said, “synchronize their watches” you guessed correctly. And, why do they do it? Because timing is everything. The Network Time Protocol (NTP) does the same thing for your systems and for the same reasons; it keeps them synchronized.

Why is system time synchronization so important? If you’ve ever seen the message, “modification times are in the future” or had the misfortune to have your SAN or network attached storage deny access to a system or user account because of a time sync problem, you know why. Time sychronization is also important when you need to compare logged events between a system and a network device.

The Basics

Installing NTP on your system, if it’s not already installed, only takes a few seconds to accomplish.

$ sudo yum install ntp

$ sudo apt-get install ntp

NTP setup is also very easy. In fact, if you used one of the shown methods to install it on your system, it’s already setup and running on your system.

The Disregard of Timekeeping

Since system clocks don’t always correspond with software clocks, there are ways to remedy the problem. You should try these methods first and then allow NTP to do its magic.

The most basic method of setting system time is to reboot your system, enter BIOS and set it there. If your system is headless or remote, this is not really an option unless you have a hardware console into your system that allows you to view the rebooting system remotely.

You can set your Linux (software) clock with the date command.

$ sudo date --set="6/23/10 11:30"

You can also sync your software clock to the hardware clock.

sudo hwclock --hctosys

Note that if your hardware clock is set to Universal Coordinated Time (UTC) time, you have to set the system clock to UTC.

$ sudo hwclock --hctosys --utc

Set your timezone so that your computer will adjust for leap years and daylight savings time changes.

sudo tzselect

sudo dpkg-reconfigure tzdata

Basic NTP Configuration

When you installed NTP via a package manager, a generic set of time servers (synchronization hosts), located in /etc/ntp.conf came with that setup. For a CentOS system, they are:

server 0.centos.pool.ntp.org
server 1.centos.pool.ntp.org
server 2.centos.pool.ntp.org

For a Debian system:

server 0.debian.pool.ntp.org iburst dynamic
server 1.debian.pool.ntp.org iburst dynamic
server 2.debian.pool.ntp.org iburst dynamic
server 3.debian.pool.ntp.org iburst dynamic

Should you find that these generic systems don’t work well for you, you have the option of configuring your own reference servers in the /etc/ntp.conf file.

The /etc/ntp.conf also contains a reference to a “drift” file. Although you can place the file anywhere you want, the default location is /var/lib/ntp and named drift or ntp.drift. The drift file contains a number that corresponds to the system clock drift or frequency error. The ntpd updates the file once an hour. NTP refers to this number to adjust the system clock and it does so in very small increments so that it doesn’t cause problems along the way for your system’s critical files and logs. It can take a day or more for NTP to correct your system time.

Note that it’s not recommended that you make large forcible updates to your system time since many files on your system are time-sensitive. Allow NTP to do its job on its own time.

NTP Queries

“Since before your sun burned hot in space and before your race was born, I have awaited a question.” You can ask NTP questions concerning status, peers, polling, statistics and much more. You can use the query commands, ntpq and ntpdc, in interactive mode or via the command line with switches and options. The ntpdc only operates in interactive mode. Shown below are two examples of interesting NTP query commands.

$ sudo ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
+clock-b.develoo 164.67.62.212    2 u  466  512  377   59.690    3.527   1.180
+97.f7bed1.clien 130.207.244.240  2 u  210 1024  377   75.032    5.022   1.994
*clock-a.develoo 209.81.9.7       2 u  299 1024  377   64.866    3.123   2.543
 LOCAL(0)        .LOCL.          10 l   11   64  377    0.000    0.000   0.244

$ nslookup 164.67.62.212

Non-authoritative answer:
212.62.67.164.in-addr.arpa      name = tock.ucla.edu.

$ sudo ntpdc
ntpdc> sysstats
time since restart:     50023
time since reset:       50023
packets received:       681
packets processed:      642
current version:        643
previous version:       0
bad version:            0
access denied:          0
bad length or format:   0
bad authentication:     0
rate exceeded:          0
ntpdc>

To see all possible options for each command, use help while in interactive mode. For help on specific options, use help option.

Don’t be fooled by NTP’s easy setup and low maintenance configuration. NTP is an old and complex protocol but the good news is that you don’t have to know every detail about it to successfully setup and sync your systems to accurate timeclocks. Your primary goal, when it comes to NTP, is to “set it and forget it” and allow it to perform on its own. NTP doesn’t require a huge amount of effort or tweaking but it can morph into a time vacuum if you allow it to.

Next week, you’ll learn more about NTP commands and advanced NTP configuration.