NTP Server Logs

[hiboujid]

i deleted the lines added to ntp.conf once i got your answer (iptables)

however the problem is still the same :

i can see the entries about the firewall rule in syslog but there is no indication about what have been done in NTP, the synchronization is it ok ? any error ? difference between the 2 clocks ....

[SeijiSensei]

ntpd never logs things like that. You can look at the client to see if the client successfully synchronized with the server. Why would think it is not working? I've used ntpd for years, and it is very reliable. It is pretty much a "set-it-and-forget-it" type of daemon.

[hiboujid]

Ok thanks

we have a lot of DMZs, lot of PCs, Servers, we wanted to have a single log file to search for anomalies in NTP protocol

i agree that in general it's a "set-it-and-forget-it" but sometimes there is some equipements with the wrong date that cannot synchronize their clock (example bios pb, ...), there is also some equipements that cannot synchronize their clock if the difference betwenn the 2 clocks is big even if they have the correct date.

so it's about a centralized view for troubleshooting.

Thanks

[Lars Noodén]

If you want centralized logging, you can have the clients running ntpd forward part of their syslog activity to a central server. Take a look at the manual page for rsyslogd and for rsyslog.conf and look for the material on remote forwarding. Unfortunately there does not seem to be an obvious way to have ntpd log to a customized log facility (e.g. local0). That would make it easier to sort. The package logwatch on the central log server might help.

[SeijiSensei]

I looked at the source code for ntpd. It looks like you could alter the file [ntp-source-root]/lib/isc/log.c to change the name of facility being used. I'm not a C programmer, but if you have any around, ask them to take a look at the source.

Current release version: http://www.eecis.udel.edu/~ntp/ntp_s...4.2.6p5.tar.gz

[koenn]

Unfortunately there does not seem to be an obvious way to have ntpd log to a customized log facility (e.g. local0). That would make it easier to sort.

rsyslog has a pretty advanced filtering mechanism (host, originating program, specific strings occuring in the log message, ...) so it's probably doable to filter out 'ntp' log entries and direct them to a dedicated log

[Lars Noodén]

rsyslog has a pretty advanced filtering mechanism (host, originating program, specific strings occuring in the log message, ...) so it's probably doable to filter out 'ntp' log entries and direct them to a dedicated log

The manual page for rsyslog.conf doesn't give much help with examples or clarification. There is the online documentation for rsyslogd but it could also be made more clear. I guess the place to start would be here:

http://www.rsyslog.com/doc/property_replacer.html

[koenn]

The manual page for rsyslog.conf doesn't give much help with examples or clarification. There is the online documentation for rsyslogd but it could also be made more clear.

True, and sometimes it's even more confusing when the documentation describes features that are not yet available in the version ubuntu or debian are using.

FWIW, I wrote down some reminders when i first tackled (centralized) ligging with rsyslog : http://users.telenet.be/mydotcom/howto/linux/syslogserver.html

[gordon4]

i deleted the lines added to ntp.conf once i got your answer (iptables)

however the problem is still the same :

i can see the entries about the firewall rule in syslog but there is no indication about what have been done in NTP, the synchronization is it ok ? any error ? difference between the 2 clocks ....

Ahhhhhh .....hiboujid ntp traffic is UDP traffic, you don't have too much to see there.

You need to check this information from the client, try 'ntpq -p', 'ntptrace' commands or see the log file of client.