ntp alerts in syslogs

Unanswered Question
Mar 8th, 2010
User Badges:

Hey All,


I've just started receiving the below messages in the syslog of our publisher call manager 6.1, the clock on the main NTP is correct, what do these mean? should they be appearing in the syslog?



Date: Mar 6 08:02:25
Machine Name: xxxxx

Severity: Notice
Process:  ntpd[4516]
Message: : time slew 0.000000 s


Date: Mar 6 08:02:31
Machine Name: xxx
Severity: Notice
Process:  ntpd[5131]
Message: : ntpd [email protected] Tue Feb 24 06:32:25 EST 2004 (1)

Date: Mar 6 08:02:31
Machine Name: xxx
Severity: Info
Process:  ntpd[5131]
Message: : precision = 9 usec

Date: Mar 6 08:02:31
Machine Name: xxx
Severity: Notice
Process:  ntpd[5131]
Message: : kernel time discipline status 0040

Date: Mar 6 08:02:31
Machine Name: APPCAMPR01
Severity: Info
Process:  ntpd[5131]
Message: : frequency initialized -15.326 from /etc/ntp/drift

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
alanc3141592654 Mon, 03/08/2010 - 18:07
User Badges:

Thanks for your reply...


If i check the NTP server from the pub I get



192.168.32.43The NTP service is accessible.


If i check the NTP status from the console of the pub I get


admin:utils ntp status
ntpd (pid 27280) is running...

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
127.127.1.0     127.127.1.0     10 l   42   64    3    0.000    0.000   0.004
192.168.32.43   192.168.32.41    3 u   15   64    3    0.226  -10102.   1.146


unsynchronised
  time server re-starting
   polling server every 16 s

Current time in UTC is : Tue Mar  9 01:49:06 UTC 2010
Current time in Australia/Brisbane is : Tue Mar  9 11:49:06 EST 2010


So, If the NTP service is accessible? why is it un sychronised?


Many Thanks,


A

David Hailey Mon, 03/08/2010 - 20:33
User Badges:
  • Purple, 4500 points or more

I have seen random issues with the NTP stratum and sync between different versions of CUCM.  What stratum is your NTP server set to?  You could try to adjust it to (the stratums go from high to low with lower being better, so you can start at 9 and go down from there to see if there is a difference.  CUCM needs 9 or greater - in other words 1 - 9) and reset the NTP service to see if you can get in sync.  Also verify that the CLI output is correct by pinging the NTP server directly from the CLI of CUCM.


Hailey


Please rate helpful posts!

William Bell Mon, 03/08/2010 - 21:09
User Badges:
  • Purple, 4500 points or more

I for one question whether "accessible" is saying "I can confirm the host is alive on the network" or if it actually means "I have talked to this host on port 123 and it responded in a positive fashion".


In either case, you seeing the server as "accessible" doesn't mean the CUCM is synchronized (as you already know).  Have you checked 192.168.32.43 to see if it is synchronized correctly to 192.168.32.41 (the reference clock for .43)?  Are you able to configure another host (like a cisco router or switch) to recover clock form 192.168.32.43? If so, does the test host show a ntp status of synchronized?


Also, what is 192.168.32.43?  Is it a router? A hardware clock? Linux host? Windows host?


Finally, do you know if the CUCM publisher was ever able to synchronize clocks with .43?


Regards,
Bill

htluo Tue, 03/09/2010 - 05:18
User Badges:
  • Red, 2250 points or more

Is your NTP source a Windows server?


The only way to troubleshoot this is by packet capture.  Here's the procedure:


1) SSH into CUCM pub, type the command below:

utils network capture file ccm count 100000 size all host all 192.168.32.43

2) Opne another SSH into CUCM pub, type the command below:

utils ntp restart

3) Wait for 1 minute.


4) Go back to the first SSH windows and press Ctrl-C to stop the capture.  Then type the command below:

file get activelog platform/cli/ccm.cap

You'll need a SFTP server to receive the file.  If you're running a newer version (such as 6.1.4, or 7.x), you may also use RTMT to get the capture file.


Upload the capture file here.  We should be able to tell.


Thanks!

Michael

alanc3141592654 Tue, 03/09/2010 - 15:22
User Badges:

thanks for your replies and tips, I will go through these today.


192.168.32.43 is a windows 2003 server, I'm aware windows does not use true NTP, but call manager understands sntp ?


Thanks again.


A

htluo Tue, 03/09/2010 - 16:18
User Badges:
  • Red, 2250 points or more

For Windows server, there are some registry to tune to get it worked.


1) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags

Set this to 5


2) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\LocalClockDispersion

Set this to 0


3) Restart "Windows Time Service"


4) On CUCM pub, type

utils ntp restart

If still not work, we need packet capture.


Michael

alanc3141592654 Wed, 03/10/2010 - 16:36
User Badges:

Hey Guys,


looks like an issue with the windows servers ntp... they've yet to fix it, But we pointed the ccm pub at a unix box for NTP and it worked straight away

and no more NTP sys logs.


So, thank you all for your help

Actions

This Discussion