Create an NTP environment in Centos

Source: Internet
Author: User

Create an NTP environment in Centos

Recently, an Openstack and Ceph cluster were built. Because multiple nodes exist in the cluster and time synchronization is required between nodes, NTP is required. In addition, in some cases, the network environment is closed, therefore, you need to build an NTP server.

Server IP Address

Role

Description

Synchronization mode

192.168.100.203

NTPD service

1. synchronizes the standard time with the external public NTPD service

2. Serve as an NTPD service for internal and external networks

Smooth synchronization of NTPD services

192.168.40.xxx

Internal and external NTP clients

Synchronization time between Intranet devices and 192.168.100.203

Smooth synchronization of NTPD services

NTP time synchronization mode selection

There are two NTP Synchronization Methods in linux: Use the ntpdate command to synchronize directly and use the NTPD service for smooth synchronization. What is the difference? To put it simply, the concept will not be blurred after a long time.

The current system time of an existing device is. The actual current time (in the air, maybe on a satellite, here is assumed to be at the upper-level target NTP server for synchronization) is. If we use ntpdate synchronization (ntpdate-u destination NTP server IP address), the operating system time will be updated to immediately. If our system has a scheduled application that runs at every day, now that the task has run (the current time is) and is changed to 12: 30 by ntpdate, the task will be executed again after 10 minutes, this is terrible. This task can only be executed once !! I think you (actually me) have understood the hidden risks of ntpdate time synchronization. Of course, this example is extreme, but it is indeed risky. I don't plan to do this in the production environment, so it is better to be secure. Therefore, the solution to this problem is to smoothly change the time without having a time point experienced twice in a day. This is the smooth synchronization time of the NTPD service, the offset of each synchronization time will not be too steep, but it will take a long time (Q: How can this problem be solved? I only know one synchronization at a time, but it takes a long time to complete synchronization, therefore, you must manually synchronize ntpdate before enabling NTPD service synchronization ).

Install configurations

The CentOS 6.3 system already comes with the NTPD service, which is usually followed by default. If it is not installed, check it first, configure the yum repository, and install it in the yum mode. The details are as follows:

[Plain] view plaincopyprint?
  1. # Rpm-qntp

If not, follow the steps below

[Plain] view plaincopyprint?
  1. # Yuminstallntp

Install the NTP software package on each server on the Intranet according to the above installation method.

After that, you must configure the NTP service to start automatically.

[Plain] view plaincopyprint?
  1. # Chkconfigntpdon
  2. # Chkconfig -- listntpd

Before configuration, use ntpdate to manually synchronize the time, so that the time difference between the local machine and the external time server is too large, so that ntpd cannot be synchronized normally.

[Plain] view plaincopyprint?
  1. # Ntpdate-u202.112.10.36
  2. 22Dec16: 52: 38 ntpdate [6400]: adjusttimeserver202.112.10.36offset0.012135se
Configure Intranet NTP-Server (192.168.100.203)

The following describes how to configure the Intranet NPTD server (192.168.100.203). The core of the NTPD service configuration is in the/etc/ntp. conf file. The articles on the Internet, especially for foreigners, are very simple. I am fooled. Mom, the basic environment is different. We have to have Chinese characteristics. First, go to the configuration file. Later, the red part is my modification, and the others are the default ones.

[Plain] view plaincopyprint?
  1. # Formoreinformationaboutthisfile, seethemanpages
  2. # Ntp. conf (5), ntp_acc (5), ntp_auth (5), ntp_clock (5), ntp_misc (5), ntp_mon (5 ).
  3. Driftfile/var/lib/ntp/drift
  4. # Permittimesynchronizationwithourtimesource, butdonot
  5. # Permitthesourcetoqueryormodifytheserviceonthissystem.
  6. Restrictdefaultkodnomodifynotrapnopeernoquery
  7. Restrict-6defaultkodnomodifynotrapnopeernoquery
  8. # Permitallaccessovertheloopbackinterface. thiscocould
  9. # Betightenedaswell, buttodosowouldeffectsomeof
  10. # Theadministrativefunctions.
  11. Restrict127.0.0.1
  12. Restrict-6: 1
  13. # Hostsonlocalnetworkarelessrestricted.
  14. # Allow synchronization time of other machines on the Intranet
  15. Restrict192.168.401_mask1_255.255.0nomodifynotrap
  16. # Usepublicserversfromthepool. ntp. orgproject.
  17. # Pleaseconsiderjoiningthepool (http://www.pool.ntp.org/join.html ).
  18. # China's most active time server: http://www.pool.ntp.org/zone/cn
  19. Server210.72.145.44perfer # China National Time Center
  20. Server202.112.10.36 # 1.cn.pool.ntp.org
  21. Server59.124.196.83 # 0.asia.pool.ntp.org
  22. # Broadcast192.168.40.255autokey # broadcastserver
  23. # Broadcastclient
  24. # Broadcast224.0.1.1autokey # multicastserver
  25. # Multicastclient224.0.1.1 # multicastclient
  26. # Manycastserver239.425254.254 # manycastserver
  27. # Manycastclient239.415254.254autokey # manycastclient
  28. # Allowupdatetimebytheupperserver
  29. # Allow the upper-layer time server to actively modify the local time
  30. Restrict210.72.145.44nomodifynotrapnoquery
  31. Restrict202.112.10.36nomodifynotrapnoquery
  32. Restrict59.124.196.83nomodifynotrapnoquery
  33. # UndisciplinedLocalClock. Thisisafakedriverintendedforbackup
  34. # Andwhennooutsidesourceofsynchronizedtimeisavailable.
  35. # When the external time server is unavailable, use the local time as the time service
  36. Server127.127.1.0 # localclock
  37. Fudge127.127.1.0stratum10
  38. # Enablepublickeycryptography.
  39. # Crypto
  40. Includefile/etc/ntp/crypto/pw
  41. # Keyfilecontainingthekeysandkeyidentifiersusedwhenoperating
  42. # Withsf-rickeycryptography.
  43. Keys/etc/ntp/keys
  44. # Specifythekeyidentifierswhicharetrusted.
  45. # Trustedkey4842
  46. # Specifythekeyidentifiertousewiththentpdcutility.
  47. # Requestkey8
  48. # Specifythekeyidentifiertousewiththentpqutility.
  49. # Controlkey8
  50. # Enablewritingofstatisticsrecords.
  51. # Statisticsclockstatscryptostatsloopstatspeerstats

For a simple description of configuration parameters and commands, see: http://linux.vbird.org/linux_server/0440ntp.php#server_ntp.conf

The configuration file is modified, saved and exited, and the service is started.

[Plain] view plaincopyprint?
  1. # Servicentpdstart

After startup, it usually takes about 5-10 minutes to start synchronization with the external time server. You can run a command to query the NTPD service status.

View service connections and listeners

[Plain] view plaincopyprint?
  1. # Netstat-tlunp | grepntp
  2. Udp00192.168.100.203: 1230.0.0.0: * 23103/ntpd
  3. Udp00127.0.0.1: 1230.0.0.0: * 23103/ntpd
  4. Udp000.0.0.0: FIG: * 23103/ntpd
  5. Udp00fe80: 6cae: 8bff: fe3d: f65: 123: * 23103/ntpd
  6. Udp00fe80: 6family: 8bff: fe3d: f65: 123: * 23103/ntpd
  7. Udp00: 1: 123: * 23103/ntpd
  8. Udp00: 123: * 23103/ntpd

Ntpq-p: view the NTP server in the network and display the relationship between the client and each server.

[Plain] view plaincopyprint?
  1. # Ntpq-p
  2. # Ntpq-p
  3. Remoterefidsttwhenpollreachdelayoffsetjitter
  4. ========================================================== ==============================================
  5. * 202.112.10.36202.112.10.602u277128314201.5539.1931721368
  6. + 59.124.196.83129.6.15.282u8812837771.153-25.11114.004
  7. LOCAL (0). locl.10l15643770.20..0000.000

Location

Flag

Description

Symbol

*

Response NTP server and the most accurate Server

+

NTP server responding to this query request

Blank (Space)

NTP server with No Response

Title

Remote

Name of the NTP server responding to this request

Refid

Name of the higher-level server used by the NTP server

St

Level of the NTP server that is responding to the request

When

Number of seconds since the last successful request

Poll

How often does the local server and remote server synchronize data? Unit: seconds. When NTP is started, the poll value is relatively small and the server synchronization frequency is high, you can adjust it to the correct time range as soon as possible. Then, the poll value will gradually increase and the synchronization frequency will decrease accordingly.

Reach

It is an octal value to test whether a connection can be established with the server. The value of each successful connection increases.

Delay

The round-trip time required to send synchronization requests from the local machine to the ntp server

Offset

The Time offset between the host and the synchronization time source through the NTP clock, in milliseconds. The closer the offset is to 0, the closer the time between the host and the ntp server is.

Jitter

Calculates the distribution of offset in a specific continuous number of connections. Simply put, the smaller the absolute value, the more accurate the host time.

The ntpstat command is used to check the time synchronization status. It usually takes 5 to 10 minutes to connect to and synchronize data. Therefore, wait a moment after the server is started.

When starting, it is generally:

[Plain] view plaincopyprint?
  1. # Ntpstat
  2. Unsynchronised
  3. Timeserverre-starting
  4. Pollingserverevery64s

After connection and synchronization:

[Plain] view plaincopyprint?
  1. SynchronisedtoNTPserver (202.112.10.36) atstratum3
  2. Timecorrecttowithin275ms
  3. Pollingserverevery256s

OK. The intranet NTPD service has been configured. If all devices are normal, configure other devices in the intranet and use this server as the time synchronization service.

Configure Intranet NTP-Clients

Other devices on the Intranet are configured as NTP clients, which are relatively simple and the configurations of all devices are the same.

Install the NTPD service and configure it to self-start (exactly the same as NTP-Server ). Find one of the configuration files/etc/ntp. conf. After the configuration is verified, copy the file to another client and use it directly.

[Plain] view plaincopyprint?
  1. # Yuminstallntp
  2. # Chkconfigntpon
  3. # Vim/etc/ntp. conf
[Plain] view plaincopyprint?
  1. Driftfile/var/lib/ntp/drift
  2. Restrict127.0.0.1
  3. Restrict-6: 1
  4. # Set the time server to a local time server
  5. Server192.168.100.203
  6. Restrict192.168.100.203nomodifynotrapnoquery
  7. Server127.127.1.0 # localclock
  8. Fudge127.127.1.0stratum10
  9. Includefile/etc/ntp/crypto/pw
  10. Keys/etc/ntp/keys

Save and exit. Use ntpdate to manually synchronize the time before requesting the server

[Plain] view plaincopyprint?
  1. # Ntpdate-u192.168.0.135
  2. 22Dec17: 09: 57 ntpdate [6439]: adjusttimeserver192.168.100.203offset0.004882sec


Synchronization may fail. Generally, the reason is that the local NTPD server is not properly started. It usually takes several minutes to start synchronization.

For error determination, refer to the subsequent error handling.

[Plain] view plaincopyprint?
  1. # Servicentpdstart

View synchronization status after startup

[Plain] view plaincopyprint?
  1. # Ntpq-p
  2. # Ntpstat
! To perform daily time correction, you can write cron

[Root @ test root] # vi/etc/crontab
# Add this line: 10 5 * root/usr/sbin/ntpdate192.168.100.203;/sbin/hwclock-w
After cron is used, the Linux system automatically performs network Calibration at every day.

Troubleshooting

Used to collect installation, configuration, and Application Problems

Error 1: ntpdate-u ip-<no server suitable for synchronization found

Judgment: the ntp client uses ntpdate-d serverIP to view the error "Server dropped: strata too high" and displays "stratum 16 ". Normally, the value range of stratum is "0 ~ 15 ".

Cause: the NTP server is not synchronized with itself or its server. After you restart the ntp service on the ntp server, it may take five minutes for the ntp server to synchronize itself or with its server, during this time, when the client runs the ntpdate command, the no server suitable for synchronization found error is generated.

Processing: Wait a few minutes and try again.

You can also run the ntpq-p command to view the situation.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.