Configuring an NTP client in Solaris 11

Quicksearch

Disclaimer

The individual owning this blog works for Oracle in Germany. The opinions expressed here are his own, are not necessarily reviewed in advance by anyone but the individual author, and neither Oracle nor any other party necessarily agrees with them.

Navigation

< Solaris 11 features: nscfg | BSD on a DUINOMITE >

Configuring an NTP client in Solaris 11

Tuesday, April 3. 2012

It is really easy to configure an NTP client on a plain standard Solaris 11 (that said it isn't more difficult on Solaris 10 ... it's the same procedure). So i will just give a very short walkthrough.

At first you have to create a config file. You can edit /etc/inet/ntp.client, edit it and copy it to /etc/inet/ntp.conf

# echo "server 0.pool.ntp.org" > /etc/inet/ntp.conf
# echo "server 1.pool.ntp.org" >> /etc/inet/ntp.conf
# echo "server 2.pool.ntp.org" >> /etc/inet/ntp.conf
# echo "server 3.pool.ntp.org" >> /etc/inet/ntp.conf

I'm prefering using 4 time servers. I think you could either use 1 or 4 ntp servers. Never use 2. And don't use three, as when one fails, you have two time servers. And as i said, never use two. Why? An old saying goes: You never know how late it is when you have two clocks. I suggest reading the pool.ntp.org website for choosing a pool as there are continental and country-wide pools as well that may result in a more precise time. As Brian correctly stated in the comments, choosing a pool with servers containing only servers near you can really influence the precision of the time. So for example when you are living in the germany, you would use 0.de.pool.ntp.org for example, when you are living in the United states you would use 0.us.pool.ntp.org.

Now we add some additional configuration information. It's more or less a copy of the stuff in /etc/inet/ntp.client:

# echo "driftfile /var/ntp/ntp.drift" >> /etc/inet/ntp.conf
# echo "statsdir /var/ntp/ntpstats/" >> /etc/inet/ntp.conf
# echo "filegen peerstats file peerstats type day enable" >> /etc/inet/ntp.conf
# echo "filegen loopstats file loopstats type day enable" >> /etc/inet/ntp.conf

As you surely know, the ntp daemon doesn't synchronize time, when the time offset between time on the client and the time on the server is too large. So doing a ntpdate to initially force a time sync is a good idea:

# ntpdate 0.pool.ntp.org
 3 Apr 13:46:49 ntpdate[1183]: step time server 205.233.73.201 offset -7200.059798 sec

Now we just have to enable ntp via SMF

# svcadm enable ntp

And voila, one line has a *. NTP is starting to do it's job:

root@solaris:/home/jmoekamp# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*name1.glorb.com 128.252.19.1     2 u   26   64  377  115.686  -79.812  12.485
+javanese.kjsl.c 69.36.224.15     2 u   40   64  377  107.082  -76.553   7.621
+10504.x.rootbsd 192.5.41.209     2 u   50   64  377  170.988  -73.474   5.841
-bindcat.fhsu.ed 192.43.244.18    2 u   47   64  377  137.639  -65.591   6.667

Posted by Joerg Moellenkamp in General at 16:45 | Comments (2) | Trackbacks (0)

View as PDF: This entry | This month | Full blog

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

I couple of comments. The version of NTP delivered with with Solaris 11 is NTP v4, while Solaris 10 ships with both. To allow them to go exist on S10, the v4 service is ntp4. Doing "svcadm enable ntp" on S10 will enable the v3 service. Which is okay, since the ntp.conf you created will work for either of them.

However, since v4 is available, you might as well use it, since it has had 15 years more development in it. So, I suggest you add the "iburst" keyword to the end of the server lines: "server 0.pool.ntp.org iburst" Normally NTP takes 5 poll periods to accept a server. The iburst keyword tell it to shorten the poll period from 64 seconds to 1 second for the first 5 polls after it starts up. This means that it synchronizes the clock immediately instead of after 5 minutes.

You don't need to run ntpdate. In S10, ntpdate is run automatically whenever the ntp service is started. In S11 the first time NTP is started after a reboot, it will accept a single clock step regardless of size.

If you can, you should specify your country code on the server line when you are using the pool servers:
0.us.pool.ntp.org. Unlike most Internet services, the accuracy of NTP is dependent on the number of hops away the server is from the client. It is best to use the closest servers you can, so the pool maintainers try to fill up the country code aliases with servers from that or a nearby country.

Another suggestion is is you are using NTP v4 and the pool servers, you can use the "pool" keyword instead of "server". This tells NTP to configure all of the IP addresses returned from the DNS lookup, not just the first one. Then you only need one pool line instead of several server lines.

#1 Brian Utterback (Homepage) on 2012-04-03 20:09 (Reply)

Thank you for the hints ... i didn't knew that about after-reboot behaviour as i do this first ntpdate ... well ... since i use ntp ...

And it's pretty much the same configuration that i'm using since then ... i think for most use cases more than enough.

Obviously you are right with the ntp4 stuff in Solaris 10. However i thought a moment if i should to elaborate more on this. However as far as know we have ntp4 in Solaris 10 only since U8 and the patch bundles doesn't contain the ntpv4 stuff. Given the legion of systems on a level sub U8 thought i keep it simple before elaborating on the Solaris pre u8 and u8 and later difference in a Solaris 11 article.

Your comment with the country pools is really important. That's the reason why i've linked to the pool webpage. I just can give several +1 to your suggestion.

#1.1 Joerg M. (Homepage) on 2012-04-03 20:46 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	E-Mail addresses will not be displayed and will only be used for E-Mail notifications. To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: Standard emoticons like :-) and ;-) are converted to images. Enclosing asterisks marks text as bold (word), underscore are made via _word_.
	Remember Information? Subscribe to this entry