Ntpq P .init. 16 U 128 0 0.000 0.000 0.000
- Ntpq P .init. 16 U 128 0 0.000 0.000 0.000 For Sale
- Ntpq P .init. 16 U 128 0 0.000 0.000 0.000 Dollar
You want the 'local clock' entry to be there (for fall-back when the intra- or internet goes away) and I specify three pool servers to be in the US (wherever you are physically you want to use the country code to limit your possible choices to time servers as electrically close to you as you can - ping comes in handy for this). Something else you may want to do is, in the NTPD start-up file. 16 u 665 1024 0 0.000 0.000 0.000 ntpq - as shows 'reject' in the condition line: # ntpq ntpq as ind assID status conf reach auth condition lastevent cnt 1 yes yes none reject Any idea how to solve this? (I would rather not use ntpdate).
TL; DR
VM using KVM, time is not synchronized. After a 2 minute suspend, it keeps a permanent 2 min gap. Setting up another VM with different network config shows that network config prevents ntp from working. Fixing this network issue is out of topic.
However, the new VM that does not have the network issue does not synchronize either after a resume. Same test: suspend 2 minutes. Check the date difference with a machine that is properly synced. The 2 min delay is permanent.
This seems to be a common issue and there is controversy about how to keep a VM synchronized, and about using NTP and kvm-clock at the same time. I found many references to that but no answer.
Question
I have a Debian VM with ntpd running but not correcting time. For instance, after a suspend/resume, I get a permanent 2 minute offset.
/etc/ntp.conf is default or close to default, nothing fancy:
ntpq seems to report a problem:
However, I'm not a netcat wizard, but AFAIU outgoing traffic on UDP port 123 goes through:
Is this test enough to rule out the firewall issue?
The host (also a Debian machine) has the same NTP configuration and synchronization is working. The network config for both machines is different, which is why I'm thinking it might be a network issue.
Any other useful test I could run?
I don't think the tinker panic 0 parameter is relevant here as it is meant to force updates on huge gaps, not 2 minute gaps. And anyway, AFAIU, it would affect the behavior in case of time offset, but it would not solve ntpq -pn returning only zeros.
FWIW, other test outputs inspired from this question:
tcpdump / ntpdate tests
On a machine where NTP sync works correctly, I launch tcpdump udp port ntp and when I restart ntpd, I see this kind of output:
On the machine I have the issue with, I don't see any output at all when restarting ntpd (no request, no reply). Shouldn't I at least see the requests?
On the good machine:
On the bad machine:
Test with another VM
We setup another VM with the same NTP configuration but another network configuration.
This results of tcpdump and ntpdate are correct and ntpq -pn returns good results. So apparently, the network configuration is indeed an issue on the faulty VM. How to open key files in windows 7.
However, the new VM does not synchronize either. If I suspend it so that it has about 100s lag, it does not synchronize (I mean after a few minutes, the gap is still the same number of seconds). However, when restarting ntpd, it synchronize instantly.
I appear to have two issues:
Network config on the first VM
ntp does not synchronize on both (unless restarted)
1 Answer
Problem solved.
Network issue
The VM had network issues preventing ntpd to succeed. It has two eth interfaces, and the one with the gateway goes through a router we don't manage directly. Although my tests wouldn't show it, I guess some UDP frames were blocked. We set up another VM with another network config and ntpq yielded better results.
Ultimately, we changed the ntp config so that the host broadcasts time locally and all VM synchronize on it. Makes more sense and minimizes load on public ntp servers.
ntpd sets clock instantly after a few minutes
One thing that probably mislead me during the tests is that ntpd does not synchronize immediately. I thought it would detect a gap right away and then modify the clock speed so that the clock progressively joins the source clock. In fact, we noticed that (unless ntpd is restarted) the clock is unchanged for a few minutes then all of a sudden it is set what seems instantly. In the meantime, the rightmost columns in ntpq output show that synchronization is going on.
This ntpd behavior probably explains why I thought ntpd didn't work even if it did. I just didn't wait long enough and I didn't understand ntpq output.