ntp alerts in syslogs

Unanswered Question
Mar 8th, 2010

Hey All,

I've just started receiving the below messages in the syslog of our publisher call manager 6.1, the clock on the main NTP is correct, what do these mean? should they be appearing in the syslog?

Date: Mar 6 08:02:25
Machine Name: xxxxx

Severity: Notice
Process:  ntpd[4516]
Message: : time slew 0.000000 s

Date: Mar 6 08:02:31
Machine Name: xxx
Severity: Notice
Process:  ntpd[5131]
Message: : ntpd [email protected] Tue Feb 24 06:32:25 EST 2004 (1)

Date: Mar 6 08:02:31
Machine Name: xxx
Severity: Info
Process:  ntpd[5131]
Message: : precision = 9 usec

Date: Mar 6 08:02:31
Machine Name: xxx
Severity: Notice
Process:  ntpd[5131]
Message: : kernel time discipline status 0040

Date: Mar 6 08:02:31
Machine Name: APPCAMPR01
Severity: Info
Process:  ntpd[5131]
Message: : frequency initialized -15.326 from /etc/ntp/drift

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
alanc3141592654 Mon, 03/08/2010 - 18:07

Thanks for your reply...

If i check the NTP server from the pub I get NTP service is accessible.

If i check the NTP status from the console of the pub I get

admin:utils ntp status
ntpd (pid 27280) is running...

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================     10 l   42   64    3    0.000    0.000   0.004    3 u   15   64    3    0.226  -10102.   1.146

  time server re-starting
   polling server every 16 s

Current time in UTC is : Tue Mar  9 01:49:06 UTC 2010
Current time in Australia/Brisbane is : Tue Mar  9 11:49:06 EST 2010

So, If the NTP service is accessible? why is it un sychronised?

Many Thanks,


David Hailey Mon, 03/08/2010 - 20:33

I have seen random issues with the NTP stratum and sync between different versions of CUCM.  What stratum is your NTP server set to?  You could try to adjust it to (the stratums go from high to low with lower being better, so you can start at 9 and go down from there to see if there is a difference.  CUCM needs 9 or greater - in other words 1 - 9) and reset the NTP service to see if you can get in sync.  Also verify that the CLI output is correct by pinging the NTP server directly from the CLI of CUCM.


Please rate helpful posts!

William Bell Mon, 03/08/2010 - 21:09

I for one question whether "accessible" is saying "I can confirm the host is alive on the network" or if it actually means "I have talked to this host on port 123 and it responded in a positive fashion".

In either case, you seeing the server as "accessible" doesn't mean the CUCM is synchronized (as you already know).  Have you checked to see if it is synchronized correctly to (the reference clock for .43)?  Are you able to configure another host (like a cisco router or switch) to recover clock form If so, does the test host show a ntp status of synchronized?

Also, what is  Is it a router? A hardware clock? Linux host? Windows host?

Finally, do you know if the CUCM publisher was ever able to synchronize clocks with .43?


htluo Tue, 03/09/2010 - 05:18

Is your NTP source a Windows server?

The only way to troubleshoot this is by packet capture.  Here's the procedure:

1) SSH into CUCM pub, type the command below:

utils network capture file ccm count 100000 size all host all

2) Opne another SSH into CUCM pub, type the command below:

utils ntp restart

3) Wait for 1 minute.

4) Go back to the first SSH windows and press Ctrl-C to stop the capture.  Then type the command below:

file get activelog platform/cli/ccm.cap

You'll need a SFTP server to receive the file.  If you're running a newer version (such as 6.1.4, or 7.x), you may also use RTMT to get the capture file.

Upload the capture file here.  We should be able to tell.



alanc3141592654 Tue, 03/09/2010 - 15:22

thanks for your replies and tips, I will go through these today. is a windows 2003 server, I'm aware windows does not use true NTP, but call manager understands sntp ?

Thanks again.


htluo Tue, 03/09/2010 - 16:18

For Windows server, there are some registry to tune to get it worked.

1) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags

Set this to 5

2) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\LocalClockDispersion

Set this to 0

3) Restart "Windows Time Service"

4) On CUCM pub, type

utils ntp restart

If still not work, we need packet capture.


alanc3141592654 Wed, 03/10/2010 - 16:36

Hey Guys,

looks like an issue with the windows servers ntp... they've yet to fix it, But we pointed the ccm pub at a unix box for NTP and it worked straight away

and no more NTP sys logs.

So, thank you all for your help


This Discussion