NTP problems

Question

NTP problems

This thread is a continuation of this post, which was somewhat hijacked by myself.

The output from ntpq -c la is as follows:

<pre>

ind assID status conf reach auth condition last_event cnt
===========================================================
1 33260 9014 yes yes none reject reachable 1

</pre>
I believe ntpd -q should do pretty much the same as ntpdate, but in my case, stopping the ntpd service, then issusing this command results in absolutely nothing happening, indicating that ntpd cannot sync and exit.
I have 2 Macs attached to my network, and both exhibit exactly the same behaviour - you'd start to think it was a network problem at this stage, right? However, monitoring network traffic (both from Macs and from within router), I can see that when I run ntpd -q, there is absolutely no network activity as a result of this command.

Mac OS X (10.4.6)

Posted on Apr 24, 2006 6:06 AM

Reply

Answer 1

Apr 24, 2006 6:27 AM in response to Scott Macpherson

Scott

Your output is identical to mine except for the "assID" entry. But that's the number I was after (I tried to do this as a one-liner, but I got "unreachable" when I did, whereas the interactive command (see below) gave me some useful information.

In the following, you type the stuff in green.

ntpq
ntpq> rv 33260

When you press return you'll get a whole load of stuff (hopefully). Or you may get "33260: timed out, nothing received". Post all of it here anyway. You can exit ntpq by just typing exit.

I believe ntpd -q should do pretty much the same as ntpdate,

You're going along a different path here, but maybe we'll need to pursue this later.

Reply

Answer 2

Apr 24, 2006 6:32 AM in response to Michael Conniff

When ntpq -c la produces this...

<pre>

ind assID status conf reach auth condition last_event cnt
===========================================================
1 31804 9014 yes yes none reject reachable 1

</pre>
...ntpq, rv 31804 produces this:

<pre>

status=9014 reach, conf, 1 event, event_reach,
srcadr=time.apple.com, srcport=123, dstadr=192.168.0.2, dstport=123,
leap=00, stratum=2, precision=-18, rootdelay=6.256,
rootdispersion=16.327, refid=17.254.0.49, reach=001, unreach=0, hmode=3,
pmode=4, hpoll=12, ppoll=12, flash=00 ok, keyid=0, offset=-22.807,
delay=220.999, dispersion=7937.511, jitter=0.004,
reftime=c7f75086.efb688bd Mon, Apr 24 2006 14:26:30.936,
org=c7f750aa.06821f29 Mon, Apr 24 2006 14:27:06.025,
rec=c7f750aa.28a2877e Mon, Apr 24 2006 14:27:06.158,
xmt=c7f750a9.f00c308f Mon, Apr 24 2006 14:27:05.937,
filtdelay= 221.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00,
filtoffset= -22.81 0.00 0.00 0.00 0.00 0.00 0.00 0.00,
filtdisp= 0.02 16000.0 16000.0 16000.0 16000.0 16000.0 16000.0 16000.0

</pre>

Mac mini, iBook G4 Mac OS X (10.4.4)

Reply

Answer 3

Apr 24, 2006 8:40 AM in response to Scott Macpherson

Scott

Bear with me, as the more I look into this, the more complicated it gets. Please tell me how you are connected to the Internet , including any routers etc. You could also fill in your hardware details in your profile although these are probably not relevant to this discussion.

Some things do not seem to work as I expected on my machine and I'm going to track this down some more. If you want some exciting reading in the meantime, try
http://www.ntp.org/ and http://www.eecis.udel.edu/~mills/ntp/html/index.html. You might also want to look at http://www.eecis.udel.edu/~mills/ntp/html/debug.html.

By the way, the column 1 indicators do show up if you use ntpdc -p rather than ntpq -p, although their meaning varies for this command. I wouldn't put too much trust in them though.

Reply

Answer 4

Apr 24, 2006 3:04 PM in response to Michael Conniff

My Mac mini 1.25 GHz PowerPC G4 (512 MB RAM) is connected to my router via Ethernet. All network setting within OS X (10.4.6) are out-the-box. DHCP is used, and OS X firewall is turned off.

Router is a Netgear DG834GT. Again, pretty default setup, although I've got UDP port 123 open in both directions at the moment. The router by default allows ALL outgoing communications, and dynamically updates incoming ports accordingly, so my firewall over-rule is unnecessary, but in place non-the-less until this is sorted out!

Router is connected via 2272/288kbps ADSL to BT exchange. Completely standard UK setup.

My iBook G4, which is exhibiting exactly the same NTP related behaviour, is connected wirelessly to the same router. Got the usual consumer wireless security things going, but the network connection to the Internet is a good, clear path.

I've been reading various NTP related sites over the last few days, and have worked through every troubleshooting list I've come across, with no avail. Everything seems to be working perfectly. Grrr!

Reply

Answer 5

Apr 25, 2006 3:05 AM in response to Scott Macpherson

Scott

OS X firewall is turned off.

Well, there goes my next line of enquiry! I was going to disable mine, and access my router to double check what it was doing. I don't know if NAT is influencing this, but it certainly makes use of the NTP debug tools much more difficult. Nor do I know if the choice of ISP has any influence (mine is pipex, yours is presumably BT?)

I've got UDP port 123 open in both directions

Since I last commented on this, I can now assure you that this is absolutely necessary (you'll find it in one of those links). Also, NTP does not use any TCP ports

Everything seems to be working perfectly.

… except your clock slows down!

Maybe you should consider a cron job to fire off ntpdate every so often. Other than that, I'm out of ideas for the moment.

Reply

Answer 6

Apr 25, 2006 5:47 AM in response to Michael Conniff

I left tcpdump listening to UDP port 123 last night, and it was reporting exactly what you'd expect: once every 68 minutes there was a shimmer of activity from my computer to an Apple time server, and a fraction of a second later, a reply from that Apple server back to my machine.

When I ran ntpdc -p on both my Macs this morning, my iBook had a '*' in the first column of output, indicating that the computer was indeed synchronised with the remote server. The clock was correct, but I've never noticed any problems with my iBook going dramatically off the lines time-keeping wise anyway.

However, running this command on my Mac mini - the one with the noticeable problem - revealed a '=' in the first column, which I've never seen before. This apparently means that remote server is being polled in client mode.

I'll be monitoring....

Reply

Answer 7

Apr 25, 2006 6:24 AM in response to Scott Macpherson

Scott

I see you've been busy!

my iBook had a '*' in the first column of output

I am also getting that, not only from ntpdc, but from ntpq, which wasn't happening in the last few days.

running this command on my Mac mini … revealed a '=' in the first column

Interesting. Do you see other differences?

Something else interesting, in that I cannot query the remote server directly, but I can query the "refid" server, which shows it is using a counter disciplined by a GPS receiver (and several others for fallback).

Reply

Answer 8

Apr 25, 2006 6:48 AM in response to Michael Conniff

Still no change today, other than the 'difference' reported by ntpdc, which keeps getting larger. My clock is now 37.5 seconds faster than time1.apple.com, so why is ntpdc reporting this and not doing anything about it?!
Perhaps the difference gets so large so quickly than ntpd cannot correct it by step?

Sounds like you're coming across a few bizarre findings at your end as well. I'm going to have to ignore this problem, or it'll drive me crazy!

Reply

Answer 9

Apr 25, 2006 7:20 AM in response to Scott Macpherson

Scott

Sounds like you're coming across a few bizarre findings at your end as well.

I would use the word "unexpected" rather than "bizarre" 🙂. But the difference is my clock is keeping reasonably good time.

Perhaps the difference gets so large so quickly than ntpd cannot correct it by step?

If that were the case, ntpd would exit, and you'd see a message in your system.log.

What about other differences between your two machines?

I'm going to have to ignore this problem, or it'll drive me crazy!

Or you could admit defeat and resort to a cron job as I suggested earlier. I don't much like this of course.

Reply

Answer 10

Apr 25, 2006 8:02 AM in response to Michael Conniff

I've just gotten ntpd to sync both my machines perfectly. Here's what I did:
- Turned off auto update in OS X System Preferences
- Edited /etc/ntp.conf to contain just this line:
<pre>

server time.apple.com burst iburst

</pre>The burst and iburst commands force ntpd to do a farely brutal time update, rather than the gentle ones it usually does.
- Ran ntpd manually, with -dq flags to show debugging info, and to force an immediate synchronisation.

Bingo. Took about 30 seconds, and blurted out plenty of debugging information. Why, if this works, does the default OS X ntp.conf setup not work?
My next move is to remove the burst and iburst commands from the configuration file, remove the 'q' flag from the ntpd command, and run it all again, just so I can see what's happening in the background.

Mac mini 1.25 G4, iBook 1.33 G4 Mac OS X (10.4.6)

Reply

Answer 11

Apr 25, 2006 10:14 AM in response to Scott Macpherson

Scott

I've just gotten ntpd to sync both my machines perfectly.

Full marks for persistence! 🙂

The burst and iburst commands force ntpd to do a farely brutal time update, rather than the gentle ones it usually does.

Yes, although only one of them will have an effect at any given time.

Ran ntpd manually, with -dq flags

The -q flag makes it equivalent to running ntpdate (which is now considered obsolete) and will make ntpd quit after successful synchronisation. Did you see a record of it quitting in system.log?

remove the 'q' flag from the ntpd command

Back to square one then? Interesting to see what the 'd' flag gives in that case. Don't forget to put back the 'minpoll' and 'maxpoll' in /etc/ntp.conf.

Reply

Answer 12

Apr 25, 2006 1:08 PM in response to Michael Conniff

Okay, I'm done fiddling with this, and here's my conclusion:
ntpd was always working on my Mac mini, but wasn't correcting my system's clock because of 2 things:

1. Apple's preference to automatically update the time sets the NTP server poll interval to a minimum of 68 minutes. A minimum - bear in mind the ntpd minimum defaults to 64 seconds. Apple clearly wanted to reduce load on their time servers as much as possible.

However, ntpd would eventually sort itself out after a few hours of polling at this interval. Indeed, my iBook does settle down after several hours, and runs perfectly from then on. This is where the second reason for ntpd not updating my system clock kicks in:

2. The clock on my Mac mini is very fast. It gains about 2 seconds every hour (iBook only fluctuates by a couple of hundredths of a second every hour). Again, ntpd would handle this beautifully, if it wasn't for the huge polling time set by Apple. The algorithms and formulas used to settle the polling time aren't quite geared for a combination of an hour between polls, and a clock that gains a minute every day.

From http://www.cis.udel.edu/~mills/ntp/html/ntpd.html:

In some cases involving dial up or toll services, it may be useful to increase the minimum interval to a few tens of minutes and maximum interval to a day or so. Under normal operation conditions, once the clock discipline loop has stabilized the interval will be increased in steps from the minimum to the maximum. However, this assumes the intrinsic clock frequency error is small enough for the discipline loop correct it. The capture range of the loop is 500 PPM at an interval of 64s decreasing by a factor of two for each doubling of interval. At a minimum of 1,024 s, for example, the capture range is only 31 PPM. If the intrinsic error is greater than this, the drift file ntp.drift will have to be specially tailored to reduce the residual error below this limit.

My solution: edit ntp.conf so it doesn't have the "minpoll" and "maxpoll" settings laid down by Apple. Tada!

Reply

Answer 13

Apr 26, 2006 6:02 AM in response to Scott Macpherson

Scott

Having slept on it I came to a similar conclusion – that there was nothing wrong with ntpd, your network connection or your router (the fact your iBook was OK should have led me to that conclusion much earlier). Since your software seems to be set up the same way, this pointed to hardware, specifically the clock on your Mac mini. I was thinking of suggesting a way of measuring this, but see you have done it. 2 seconds an hour doesn't sound very much, but as you have found it soon builds up. Under more normal circumstances, NTP would easily correct this.

So, well done! Post back in a week or so to tell us if all is now well! 🙂

Reply

Answer 14

May 2, 2006 8:17 AM in response to Scott Macpherson

After many hours of fiddling with this problem, and with the assistance of brilliant people like Michael, I finally solved this problem.

As my last post indicated, the problem stemmed from two things, neither of which were actually problems or errors by themselves:
First, Apple's default time-server polling settings are, in my opinion, ridiculously large. Default min/max is 64/1024 seconds, Apple have chosen 4096/131,072.

When combined with the second problem, my very-fast Mac mini's clock, NTPD simply couldn't work out the offset between the configured time server, and my Mac mini.

The solution? Over-ride Apple's default ntp.conf file configuration, by simply removing the minpoll and maxpoll settings. Restart NTPD, and within minutes everything was operating perfectly, and staying that way.

Unfortunately, if I ever open my "Date & Time" preferences panel, I have to reconfigure NTPD again.

Hope this helps someone trying to solve a dodgy NTP service on their Mac. Once again, my thanks to Michael for his help with this.

Reply

Answer 15

Thorne^

Level 2

265 points

Jun 22, 2006 9:32 AM in response to Michael Conniff

Hello Michael

Maybe you can help me too 🙂
The automatic Time Setting doesnt work correctly on my iMac Core Duo if ntpd runs. No matter which timeserver i try.
Disabled temporary the Mac OS X Firewall and the Firewall in my Speedtouch 716i Router, to make sure it isnt blocked.

Example System.log
Jun 22 17:02:32 ntpdate[102]: can't find host time.euro.apple.com\n
Jun 22 17:02:32 ntpdate[102]: no servers can be used, exiting

Manually while ntpd runs (Terminal command):

sudo ntpdate
Password:
Looking for host time.euro.apple.com and service ntp
host found : interweb.euro.apple.com
22 Jun 17:26:00 ntpdate[249]: the NTP socket is in use, exiting

If I close now the ntpd Process, works it manually:

sudo ntpdate
Looking for host time.euro.apple.com and service ntp
host found : media1r.euro.apple.com
22 Jun 17:28:07 ntpdate[254]: adjust time server 17.72.133.45 offset 0.055334 sec

If i start ntpd again and type following, can i see this:

sudo ntpq -pn
remote refid st t when poll reach delay offset jitter
======================================== ======================================
17.72.133.45 17.72.133.55 2 u 4 68m 1 49.042 26.393 0.001

ntpq -c la
ind assID status conf reach auth condition last_event cnt
======================================== ===================
1 16540 b014 yes yes none reject reachable 1

ntpq
ntpq> rv 16540
status=b014 reach, conf, 1 event, event_reach,
srcadr=interweb.euro.apple.com, srcport=123, dstadr=192.168.1.64,
dstport=123, leap=00, stratum=2, precision=-17, rootdelay=3.891,
rootdispersion=16.342, refid=17.72.133.55, reach=001, unreach=0,
hmode=3, pmode=4, hpoll=12, ppoll=12, flash=00 ok, keyid=0, ttl=0,
offset=26.393, delay=49.042, dispersion=7937.505, jitter=0.001,
reftime=c8453b5a.431c970f Thu, Jun 22 2006 17:52:58.262,
org=c8453b7f.e0f9b131 Thu, Jun 22 2006 17:53:35.878,
rec=c8453b7f.e07f023e Thu, Jun 22 2006 17:53:35.876,
xmt=c8453b7f.d3ee5eed Thu, Jun 22 2006 17:53:35.827,
filtdelay= 49.04 0.00 0.00 0.00 0.00 0.00 0.00 0.00,
filtoffset= 26.39 0.00 0.00 0.00 0.00 0.00 0.00 0.00,
filtdisp= 0.01 16000.0 16000.0 16000.0 16000.0 16000.0 16000.0 16000.0

Following was without success:
Firewall Mac OS X deactivate
Firewall Mac OS X activate with UDP Port 123 free
Firewall Router deactivate
Firewall des Routers activate with UDP Port 123 free/forwarded
Trying other Timeservers
PRAM Reset
SMC Reset
Repair User Access rights
Repair Volume
After delete of the "com.apple.networkConfig.plist" file works it, but only one time.

Installed Updates:
2006-06-12 13:42:05 +0200: Installed "iTunes" (6.0.4)
2006-06-12 13:42:17 +0200: Installed "GarageBand Update" (3.0.2)
2006-06-12 13:42:21 +0200: Installed "iDVD Update" (6.0.2)
2006-06-12 13:42:26 +0200: Installed "iPod Updater 2006-03-23" ( )
2006-06-12 13:42:35 +0200: Installed "iMovie HD Combo Update" (6.0.2)
2006-06-12 13:42:47 +0200: Installed "iPhoto Update" (6.0.3)
2006-06-12 13:42:50 +0200: Installed "iMac SMC-Firmware-Update" (1.0)
2006-06-12 13:43:04 +0200: Installed "Keynote Update" (3.0.1v2)
2006-06-12 13:43:10 +0200: Installed "Pages Update" (2.0.1v2)
2006-06-12 13:44:24 +0200: Installed "iWeb Update" (1.1.1)
2006-06-12 13:44:48 +0200: Installed "QuickTime" (7.1.1)
2006-06-12 13:46:56 +0200: Installed "Combined Mac OS X Update (Intel)" (10.4.6)
2006-06-13 12:27:34 +0200: Installed "J2SE 5.0 Release 4" (4.0)
2006-06-13 12:27:37 +0200: Installed "Front Row Update" (1.2.2)
2006-06-13 12:27:43 +0200: Installed "Apple Keyboard Update" (1.0)
2006-06-13 12:29:38 +0200: Installed "Security Update 2006-003 (Intel)" (1.0)
2006-06-21 10:07:46 +0200: Installed "iPhoto Update" (6.0.4)
and the Boot-Rom Firmware Update 1.0.1

Reply