The Loglogic appliance has a wrapper (engine_ntp) that starts, monitors and reports its status. This article addresses questions about how NTP operates in the context of LogLogic LMI.

1. What happens if the appliance is not configured with an NTP server?

The ntpd daemon still runs but without a reliable time source your appliance's system time is at risk of drifting.

2. How do I find the current NTP status from the Web UI?

        Administration->System Settings->Time
 

3. How do I find the current NTP status from the CLI?

 $ cat /loglogic/conf/ntp_status.txt

4. What if the NTP server is not available during boot time?

It shouldn't be a problem as long as the system maintains time within few minutes from the reference time. It can be adjusted once the time service is resumed. But if the appliance's system time drifts more than 5 minutes from the time server then this can cause problems when using the application such as when SSL certificates are involved, which are time sensitive. When the time source is available again the LMI application may need restarted in order to work correctly if the time adjustment is more than 1 minute.

5. What are the minimum and maximum poll intervals?

The min and max allowable polling values are 16 sec and 36 hours, respectively. The appliance uses the default 64 sec and 1024 sec. respectively. Do not change these values.

6. What is "reach" in the status?

It is an 8 bit left shift register. After every poll, left most bits are set to 0-unreachable, 1-reachable and shift the register left one bit. That becomes zero, if the remote time server is unreachable for 8 consecutive polls. The value is represented in Octal.

7. What is the typical drift of a typical appliance?

This has not been measured. It varies based on many parameters including hardware and environmental factors.

8. How much time does the NTP process take to startup during boot?

It is negligible if NTP is not configured. If configured, it waits until “sync up” with the remote host before timing out.

 
9. When does NTP report a disassociation from the time source?

If the NTP daemon failed to contact the time server continuously for more than two hours, it reports "...failing to sync with the upstream time server(s)..."

10. How frequently the hardware clock get updated?

Two times a day.

11. Does engine_ntp reboot the appliance?

It does not.

12. What are the time tolerance limits?

It can be as small as 10 secs before it starts failing some of the processes. The current model is sensitive to time change if it resets time forwards more than 60 secs. It logs a syslog and updates the status. If it is beyond a few minutes, more likely a lot of processes get restarted. If NTP updates the clock with too large of an adjustment then mtask may determine that the various engines are failing heartbeats. If the system clock is reset backwards, the appliance fails in many ways including stopping log collection. It has to wait until it reaches the time before reset unless manually restarted. In either case, it logs and updates the status.

13. How to configure an alert to know if there is a change in the system time?
Create a search filter alert the following error.

      “Failing to sync with the upstream time server(s)”

14.  Can the appliance act as a NTP server:

No.

15. Does it support multiple time servers and/or pools?

Yes, the appliance does support pools.  It is recommended to use an IP address of the server and not the IP address of the pool.

16. What is the protocol version?
Default is version 4.