Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ntp alerts in syslogs

Hey All,

I've just started receiving the below messages in the syslog of our publisher call manager 6.1, the clock on the main NTP is correct, what do these mean? should they be appearing in the syslog?

Date: Mar 6 08:02:25
Machine Name: xxxxx

Severity: Notice
Process:  ntpd[4516]
Message: : time slew 0.000000 s

Date: Mar 6 08:02:31
Machine Name: xxx
Severity: Notice
Process:  ntpd[5131]
Message: : ntpd 4.1.2@1.892 Tue Feb 24 06:32:25 EST 2004 (1)

Date: Mar 6 08:02:31
Machine Name: xxx
Severity: Info
Process:  ntpd[5131]
Message: : precision = 9 usec

Date: Mar 6 08:02:31
Machine Name: xxx
Severity: Notice
Process:  ntpd[5131]
Message: : kernel time discipline status 0040

Date: Mar 6 08:02:31
Machine Name: APPCAMPR01
Severity: Info
Process:  ntpd[5131]
Message: : frequency initialized -15.326 from /etc/ntp/drift

8 REPLIES
Red

Re: ntp alerts in syslogs

That means your CUCM was not able to synchronize time with NTP server (for whatever reasons).

Michael

http://htluo.blogspot.com

New Member

Re: ntp alerts in syslogs

Thanks for your reply...

If i check the NTP server from the pub I get

192.168.32.43The NTP service is accessible.

If i check the NTP status from the console of the pub I get

admin:utils ntp status
ntpd (pid 27280) is running...

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
127.127.1.0     127.127.1.0     10 l   42   64    3    0.000    0.000   0.004
192.168.32.43   192.168.32.41    3 u   15   64    3    0.226  -10102.   1.146


unsynchronised
  time server re-starting
   polling server every 16 s

Current time in UTC is : Tue Mar  9 01:49:06 UTC 2010
Current time in Australia/Brisbane is : Tue Mar  9 11:49:06 EST 2010

So, If the NTP service is accessible? why is it un sychronised?

Many Thanks,

A

Re: ntp alerts in syslogs

I have seen random issues with the NTP stratum and sync between different versions of CUCM.  What stratum is your NTP server set to?  You could try to adjust it to (the stratums go from high to low with lower being better, so you can start at 9 and go down from there to see if there is a difference.  CUCM needs 9 or greater - in other words 1 - 9) and reset the NTP service to see if you can get in sync.  Also verify that the CLI output is correct by pinging the NTP server directly from the CLI of CUCM.

Hailey

Please rate helpful posts!

Re: ntp alerts in syslogs

I for one question whether "accessible" is saying "I can confirm the host is alive on the network" or if it actually means "I have talked to this host on port 123 and it responded in a positive fashion".

In either case, you seeing the server as "accessible" doesn't mean the CUCM is synchronized (as you already know).  Have you checked 192.168.32.43 to see if it is synchronized correctly to 192.168.32.41 (the reference clock for .43)?  Are you able to configure another host (like a cisco router or switch) to recover clock form 192.168.32.43? If so, does the test host show a ntp status of synchronized?

Also, what is 192.168.32.43?  Is it a router? A hardware clock? Linux host? Windows host?

Finally, do you know if the CUCM publisher was ever able to synchronize clocks with .43?

Regards,
Bill

HTH -Bill (b) http://ucguerrilla.com (t) @ucguerrilla

Please remember to rate helpful responses and identify

Red

Re: ntp alerts in syslogs

Is your NTP source a Windows server?

The only way to troubleshoot this is by packet capture.  Here's the procedure:

1) SSH into CUCM pub, type the command below:

utils network capture file ccm count 100000 size all host all 192.168.32.43

2) Opne another SSH into CUCM pub, type the command below:

utils ntp restart

3) Wait for 1 minute.

4) Go back to the first SSH windows and press Ctrl-C to stop the capture.  Then type the command below:

file get activelog platform/cli/ccm.cap

You'll need a SFTP server to receive the file.  If you're running a newer version (such as 6.1.4, or 7.x), you may also use RTMT to get the capture file.

Upload the capture file here.  We should be able to tell.

Thanks!

Michael

New Member

Re: ntp alerts in syslogs

thanks for your replies and tips, I will go through these today.

192.168.32.43 is a windows 2003 server, I'm aware windows does not use true NTP, but call manager understands sntp ?

Thanks again.

A

Red

Re: ntp alerts in syslogs

For Windows server, there are some registry to tune to get it worked.

1) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags

Set this to 5

2) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\LocalClockDispersion

Set this to 0

3) Restart "Windows Time Service"

4) On CUCM pub, type

utils ntp restart

If still not work, we need packet capture.

Michael

New Member

Re: ntp alerts in syslogs

Hey Guys,

looks like an issue with the windows servers ntp... they've yet to fix it, But we pointed the ccm pub at a unix box for NTP and it worked straight away

and no more NTP sys logs.

So, thank you all for your help

1009
Views
0
Helpful
8
Replies
CreatePlease to create content