Multiple ntp processes? - NTP

This is a discussion on Multiple ntp processes? - NTP ; I didn't readily find an answer to this problem... I note when I start ntp as an init script running Fedora Core 5 on a dual PIII 450 Mhz box, I see two ntpd processes running. By looking at the ...

+ Reply to Thread
Results 1 to 16 of 16

Thread: Multiple ntp processes?

  1. Multiple ntp processes?

    I didn't readily find an answer to this problem...

    I note when I start ntp as an init script running Fedora Core 5 on a
    dual PIII 450 Mhz box, I see two ntpd processes running. By looking at
    the PID and PPID it appears one ntpd is starting the other. I note in
    /var/log/messages I will see logs with intermixed times. For instance,
    a log with time X followed by logs with X - some prior time...it's very
    odd...

    If, on the command line, I stop ntpd both processes stop fine. By
    starting ntpd again...I note only one ntpd process running.

    My question is: is this behavior normal on a dual processor box? Based
    on the odd timestamps in /var/log/messages - I would have to say only
    one ntpd should be running...it almost "feels" like the two ntpd's are
    fighting to set the system clock.

    Thanks in advance!

    Scot

    --
    Scot P. Floess
    27 Lake Royale
    Louisburg, NC 27549

    252-478-8087 (Home)
    919-754-4592 (Work)

    Chief Architect JPlate http://sourceforge.net/projects/jplate
    Chief Architect JavaPIM http://sourceforge.net/projects/javapim

    _______________________________________________
    questions mailing list
    questions@lists.ntp.isc.org
    https://lists.ntp.isc.org/mailman/listinfo/questions


  2. Re: Multiple ntp processes?

    Scot P. Floess wrote:
    > I didn't readily find an answer to this problem...
    >
    > I note when I start ntp as an init script running Fedora Core 5 on a
    > dual PIII 450 Mhz box, I see two ntpd processes running. By looking at
    > the PID and PPID it appears one ntpd is starting the other. I note in
    > /var/log/messages I will see logs with intermixed times. For instance,
    > a log with time X followed by logs with X - some prior time...it's very
    > odd...


    Yes, the second process is created by a fork of the first one. The
    second one is doing DNS lookups that it sends back to the first once it
    has a definitive answer. The second process will exit when there is no
    longer anything for it to do. This is quite normal.

    >
    > If, on the command line, I stop ntpd both processes stop fine. By
    > starting ntpd again...I note only one ntpd process running.
    >


    You should see both but it's possible that you waited too long and the
    second has already returned all of it's answers.

    > My question is: is this behavior normal on a dual processor box? Based
    > on the odd timestamps in /var/log/messages - I would have to say only
    > one ntpd should be running...it almost "feels" like the two ntpd's are
    > fighting to set the system clock.
    >


    No, this is all normal. Only one of them is setting the clock.

    Danny

    > Thanks in advance!
    >
    > Scot


    _______________________________________________
    questions mailing list
    questions@lists.ntp.isc.org
    https://lists.ntp.isc.org/mailman/listinfo/questions


  3. Re: Multiple ntp processes?

    Scot P. Floess wrote:
    > I didn't readily find an answer to this problem...
    >
    > I note when I start ntp as an init script running Fedora Core 5 on a
    > dual PIII 450 Mhz box, I see two ntpd processes running. By looking at
    > the PID and PPID it appears one ntpd is starting the other. I note in
    > /var/log/messages I will see logs with intermixed times. For instance,
    > a log with time X followed by logs with X - some prior time...it's very
    > odd...
    >
    > If, on the command line, I stop ntpd both processes stop fine. By
    > starting ntpd again...I note only one ntpd process running.
    >
    > My question is: is this behavior normal on a dual processor box? Based
    > on the odd timestamps in /var/log/messages - I would have to say only
    > one ntpd should be running...it almost "feels" like the two ntpd's are
    > fighting to set the system clock.
    >
    > Thanks in advance!
    >
    > Scot


    Only one instance of ntpd is supposed to be running. Something about
    the way you are starting your system is starting two processes. The
    most likely cause is executing the ntpd startup script twice. If you add:
    echo "Starting ntpd at `date`"
    to the script that starts ntpd, you will see the message twice during
    startup if that is your problem. I can't imagine what else it might be
    so, if it is something else, please let us know.

  4. Re: Multiple ntp processes?

    Danny Mayer wrote:

    > Scot P. Floess wrote:
    >
    >>I didn't readily find an answer to this problem...
    >>
    >>I note when I start ntp as an init script running Fedora Core 5 on a
    >>dual PIII 450 Mhz box, I see two ntpd processes running. By looking at
    >>the PID and PPID it appears one ntpd is starting the other. I note in
    >>/var/log/messages I will see logs with intermixed times. For instance,
    >>a log with time X followed by logs with X - some prior time...it's very
    >>odd...

    >
    >
    > Yes, the second process is created by a fork of the first one. The
    > second one is doing DNS lookups that it sends back to the first once it
    > has a definitive answer. The second process will exit when there is no
    > longer anything for it to do. This is quite normal.
    >
    >
    >>If, on the command line, I stop ntpd both processes stop fine. By
    >>starting ntpd again...I note only one ntpd process running.
    >>

    >
    >
    > You should see both but it's possible that you waited too long and the
    > second has already returned all of it's answers.
    >
    >
    >>My question is: is this behavior normal on a dual processor box? Based
    >>on the odd timestamps in /var/log/messages - I would have to say only
    >>one ntpd should be running...it almost "feels" like the two ntpd's are
    >>fighting to set the system clock.
    >>

    >
    >
    > No, this is all normal. Only one of them is setting the clock.
    >
    > Danny
    >
    >
    >>Thanks in advance!
    >>
    >>Scot

    >
    >
    > _______________________________________________
    > questions mailing list
    > questions@lists.ntp.isc.org
    > https://lists.ntp.isc.org/mailman/listinfo/questions
    >


    Just curious; why is it necessary to fork a second process to do the DNS
    lookups?

  5. Re: Multiple ntp processes?

    "Richard B. Gilbert" wrote:

    > Just curious; why is it necessary to fork a second process to do the DNS
    > lookups?


    So they are done asynchronously and don't block ntpd while they
    complete or timeout. I believe there are plans to incorporate
    asynchronous resolution into ntpd, so that the child fork becomes
    unnecessary.

    --
    Ronan Flood
    working for but not speaking for
    Network Services, University of London Computer Centre
    (which means: don't bother ULCC if I've said something you don't like)

  6. Re: Multiple ntp processes?

    Ronan Flood wrote:
    > "Richard B. Gilbert" wrote:
    >
    >
    >>Just curious; why is it necessary to fork a second process to do the DNS
    >>lookups?

    >
    >
    > So they are done asynchronously and don't block ntpd while they
    > complete or timeout. I believe there are plans to incorporate
    > asynchronous resolution into ntpd, so that the child fork becomes
    > unnecessary.
    >


    I can't help wondering what ntpd is going to do until its server
    addresses are resolved. . . .

  7. Re: Multiple ntp processes?

    >>> In article <2LWdnfNvMN86U67YnZ2dnUVZ_vqdnZ2d@comcast.com>, "Richard B. Gilbert" writes:

    Richard> I can't help wondering what ntpd is going to do until its server
    Richard> addresses are resolved. . . .

    Process input from refclocks, remote connections, and servers/peers that
    have already resolved, ...

    H

  8. Re: Multiple ntp processes?

    Danny:

    Thank you for the prompt reply. I just compiled the latest version of
    NTP and am not seeing double processes...but it could be I time it to
    when a second process isn't running.

    Regardless, thank you again as this is very useful information

    Scot

    Danny Mayer wrote:
    > Scot P. Floess wrote:
    >
    >> I didn't readily find an answer to this problem...
    >>
    >> I note when I start ntp as an init script running Fedora Core 5 on a
    >> dual PIII 450 Mhz box, I see two ntpd processes running. By looking at
    >> the PID and PPID it appears one ntpd is starting the other. I note in
    >> /var/log/messages I will see logs with intermixed times. For instance,
    >> a log with time X followed by logs with X - some prior time...it's very
    >> odd...
    >>

    >
    > Yes, the second process is created by a fork of the first one. The
    > second one is doing DNS lookups that it sends back to the first once it
    > has a definitive answer. The second process will exit when there is no
    > longer anything for it to do. This is quite normal.
    >
    >
    >> If, on the command line, I stop ntpd both processes stop fine. By
    >> starting ntpd again...I note only one ntpd process running.
    >>
    >>

    >
    > You should see both but it's possible that you waited too long and the
    > second has already returned all of it's answers.
    >
    >
    >> My question is: is this behavior normal on a dual processor box? Based
    >> on the odd timestamps in /var/log/messages - I would have to say only
    >> one ntpd should be running...it almost "feels" like the two ntpd's are
    >> fighting to set the system clock.
    >>
    >>

    >
    > No, this is all normal. Only one of them is setting the clock.
    >
    > Danny
    >
    >
    >> Thanks in advance!
    >>
    >> Scot
    >>

    >
    >
    >


    --
    Scot P. Floess
    27 Lake Royale
    Louisburg, NC 27549

    252-478-8087 (Home)
    919-754-4592 (Work)

    Chief Architect JPlate http://sourceforge.net/projects/jplate
    Chief Architect JavaPIM http://sourceforge.net/projects/javapim

    _______________________________________________
    questions mailing list
    questions@lists.ntp.isc.org
    https://lists.ntp.isc.org/mailman/listinfo/questions


  9. Re: Multiple ntp processes?

    Richard:

    I just built the latest point release of NTP and it seems to have fixed
    my problem. What is really strange is the same script, same rc3.d setup
    and the old version had 2 ntpd processes running...now with the new
    version (no changes other than a recompile with the new source) fixed
    the problem. Someone responded to my post and stated that it was normal
    behavior to see 2 versions running...that one was for DNS lookup and
    would exit once it's job was complete. What struck me as odd was that
    in the past on single processor machines, I never noticed more than one
    ntpd running. It was only when I had moved over to a dual PIII box that
    I would see 2 ntpd's running. As I mentioned in my post, the PPID of
    one of the ntpd's was the initially started ntpd.

    However, since I am now using the latest point release all seems better.

    On a side note, I still see in /var/log/messages odd intertwined timings
    in logs. For instance executing this:

    grep sshd /var/log/messages | grep Failed

    yields this:

    Oct 16 01:30:36 adminserver sshd[9271]: Failed password for invalid user
    tester from 210.17.215.224 port 49310 ssh2
    Oct 15 21:30:41 adminserver sshd[9272]: Failed password for invalid user
    tester from 210.17.215.224 port 50927 ssh2
    Oct 16 01:30:41 adminserver sshd[9273]: Failed password for invalid user
    tester from 210.17.215.224 port 50927 ssh2
    Oct 15 21:30:46 adminserver sshd[9274]: Failed password for invalid user
    tester from 210.17.215.224 port 52044 ssh2
    Oct 16 01:30:46 adminserver sshd[9276]: Failed password for invalid user
    tester from 210.17.215.224 port 52044 ssh2
    Oct 15 21:30:52 adminserver sshd[9277]: Failed password for invalid user
    tester from 210.17.215.224 port 54651 ssh2
    Oct 16 01:30:52 adminserver sshd[9278]: Failed password for invalid user
    tester from 210.17.215.224 port 54651 ssh2
    Oct 15 21:31:00 adminserver sshd[9279]: Failed password for invalid user
    tester from 210.17.215.224 port 56614 ssh2

    Note the timestamps... So, this started me down the whole "I have 2
    ntpd's running" issue. It felt like maybe one was trying set the date
    incorrectly...

    Thanks for your response!

    Scot

    Richard B. Gilbert wrote:
    > Scot P. Floess wrote:
    >> I didn't readily find an answer to this problem...
    >>
    >> I note when I start ntp as an init script running Fedora Core 5 on a
    >> dual PIII 450 Mhz box, I see two ntpd processes running. By looking
    >> at the PID and PPID it appears one ntpd is starting the other. I
    >> note in /var/log/messages I will see logs with intermixed times. For
    >> instance, a log with time X followed by logs with X - some prior
    >> time...it's very odd...
    >>
    >> If, on the command line, I stop ntpd both processes stop fine. By
    >> starting ntpd again...I note only one ntpd process running.
    >>
    >> My question is: is this behavior normal on a dual processor box?
    >> Based on the odd timestamps in /var/log/messages - I would have to
    >> say only one ntpd should be running...it almost "feels" like the two
    >> ntpd's are fighting to set the system clock.
    >>
    >> Thanks in advance!
    >>
    >> Scot

    >
    > Only one instance of ntpd is supposed to be running. Something about
    > the way you are starting your system is starting two processes. The
    > most likely cause is executing the ntpd startup script twice. If you
    > add:
    > echo "Starting ntpd at `date`"
    > to the script that starts ntpd, you will see the message twice during
    > startup if that is your problem. I can't imagine what else it might
    > be so, if it is something else, please let us know.
    >
    > _______________________________________________
    > questions mailing list
    > questions@lists.ntp.isc.org
    > https://lists.ntp.isc.org/mailman/listinfo/questions
    >


    --
    Scot P. Floess
    27 Lake Royale
    Louisburg, NC 27549

    252-478-8087 (Home)
    919-754-4592 (Work)

    Chief Architect JPlate http://sourceforge.net/projects/jplate
    Chief Architect JavaPIM http://sourceforge.net/projects/javapim

    _______________________________________________
    questions mailing list
    questions@lists.ntp.isc.org
    https://lists.ntp.isc.org/mailman/listinfo/questions


  10. Re: Multiple ntp processes?

    In article Harlan Stenn
    writes:
    >>>> In article <2LWdnfNvMN86U67YnZ2dnUVZ_vqdnZ2d@comcast.com>, "Richard

    >B. Gilbert" writes:
    >
    >Richard> I can't help wondering what ntpd is going to do until its server
    >Richard> addresses are resolved. . . .
    >
    >Process input from refclocks, remote connections, and servers/peers that
    >have already resolved, ...


    .... and (last but not certainly not least) discipline the local clock
    based on the saved drift value.

    --Per Hedeland
    per@hedeland.org

  11. Re: Multiple ntp processes?

    In article , per@hedeland.org (Per Hedeland) wrote:

    > .... and (last but not certainly not least) discipline the local clock
    > based on the saved drift value.


    Although that doesn't apply on Unix systems using the kernel time discipline,
    or, as far as I know, on Windows NT, as the frequency correction is locked into
    the kernel by a single call. (You can use the kernel support to trim out
    systematic frequency errors without ever running ntpd, when using Linux.)

    The other reasons still apply.

    One reason for needing the separate process is that the traditional
    implementation of the DNS resolver API in Unix is a blocking library
    routine.

  12. Re: Multiple ntp processes?

    As other, much better qualified NTPeople have already written, it's
    normal and intended that a second NTP process starts up briefly to get
    everything configured and initialised. On a very old, very slow system
    (Sun SPARCstation IPC) I can see the two processes dancing in slow
    motion. On modern hardware it's all over in a flash -- if you blink,
    you miss it.

    Paul


  13. Re: Multiple ntp processes?

    This appears to be specific to sshd. I found some information someplace
    (can't remember where) that stated something about sshd/ntpd... The
    timing appears to be related to UTC versus my local time. Of course, I
    lost the link and can't elaborate more

    But sure enough, the odd timings show current time and then current time
    minus a few hours. I can reproduce this by simply tailing
    /var/log/messages...and in an xterm ssh to my box...the timing comes out
    odd as described...

    Scot P. Floess wrote:
    > Richard:
    >
    > I just built the latest point release of NTP and it seems to have
    > fixed my problem. What is really strange is the same script, same
    > rc3.d setup and the old version had 2 ntpd processes running...now
    > with the new version (no changes other than a recompile with the new
    > source) fixed the problem. Someone responded to my post and stated
    > that it was normal behavior to see 2 versions running...that one was
    > for DNS lookup and would exit once it's job was complete. What struck
    > me as odd was that in the past on single processor machines, I never
    > noticed more than one ntpd running. It was only when I had moved over
    > to a dual PIII box that I would see 2 ntpd's running. As I mentioned
    > in my post, the PPID of one of the ntpd's was the initially started ntpd.
    >
    > However, since I am now using the latest point release all seems better.
    >
    > On a side note, I still see in /var/log/messages odd intertwined
    > timings in logs. For instance executing this:
    >
    > grep sshd /var/log/messages | grep Failed
    >
    > yields this:
    >
    > Oct 16 01:30:36 adminserver sshd[9271]: Failed password for invalid
    > user tester from 210.17.215.224 port 49310 ssh2
    > Oct 15 21:30:41 adminserver sshd[9272]: Failed password for invalid
    > user tester from 210.17.215.224 port 50927 ssh2
    > Oct 16 01:30:41 adminserver sshd[9273]: Failed password for invalid
    > user tester from 210.17.215.224 port 50927 ssh2
    > Oct 15 21:30:46 adminserver sshd[9274]: Failed password for invalid
    > user tester from 210.17.215.224 port 52044 ssh2
    > Oct 16 01:30:46 adminserver sshd[9276]: Failed password for invalid
    > user tester from 210.17.215.224 port 52044 ssh2
    > Oct 15 21:30:52 adminserver sshd[9277]: Failed password for invalid
    > user tester from 210.17.215.224 port 54651 ssh2
    > Oct 16 01:30:52 adminserver sshd[9278]: Failed password for invalid
    > user tester from 210.17.215.224 port 54651 ssh2
    > Oct 15 21:31:00 adminserver sshd[9279]: Failed password for invalid
    > user tester from 210.17.215.224 port 56614 ssh2
    >
    > Note the timestamps... So, this started me down the whole "I have 2
    > ntpd's running" issue. It felt like maybe one was trying set the date
    > incorrectly...
    >
    > Thanks for your response!
    >
    > Scot
    >
    > Richard B. Gilbert wrote:
    >> Scot P. Floess wrote:
    >>> I didn't readily find an answer to this problem...
    >>>
    >>> I note when I start ntp as an init script running Fedora Core 5 on a
    >>> dual PIII 450 Mhz box, I see two ntpd processes running. By looking
    >>> at the PID and PPID it appears one ntpd is starting the other. I
    >>> note in /var/log/messages I will see logs with intermixed times.
    >>> For instance, a log with time X followed by logs with X - some prior
    >>> time...it's very odd...
    >>>
    >>> If, on the command line, I stop ntpd both processes stop fine. By
    >>> starting ntpd again...I note only one ntpd process running.
    >>>
    >>> My question is: is this behavior normal on a dual processor box?
    >>> Based on the odd timestamps in /var/log/messages - I would have to
    >>> say only one ntpd should be running...it almost "feels" like the two
    >>> ntpd's are fighting to set the system clock.
    >>>
    >>> Thanks in advance!
    >>>
    >>> Scot

    >>
    >> Only one instance of ntpd is supposed to be running. Something about
    >> the way you are starting your system is starting two processes. The
    >> most likely cause is executing the ntpd startup script twice. If you
    >> add:
    >> echo "Starting ntpd at `date`"
    >> to the script that starts ntpd, you will see the message twice during
    >> startup if that is your problem. I can't imagine what else it might
    >> be so, if it is something else, please let us know.
    >>
    >> _______________________________________________
    >> questions mailing list
    >> questions@lists.ntp.isc.org
    >> https://lists.ntp.isc.org/mailman/listinfo/questions
    >>

    >


    --
    Scot P. Floess
    27 Lake Royale
    Louisburg, NC 27549

    252-478-8087 (Home)
    919-754-4592 (Work)

    Chief Architect JPlate http://sourceforge.net/projects/jplate
    Chief Architect JavaPIM http://sourceforge.net/projects/javapim

    _______________________________________________
    questions mailing list
    questions@lists.ntp.isc.org
    https://lists.ntp.isc.org/mailman/listinfo/questions


  14. Re: Multiple ntp processes?

    floess@mindspring.com (Scot P. Floess) wrote:

    > would exit once it's job was complete. What struck me as odd was that
    > in the past on single processor machines, I never noticed more than one
    > ntpd running. It was only when I had moved over to a dual PIII box that
    > I would see 2 ntpd's running. As I mentioned in my post, the PPID of
    > one of the ntpd's was the initially started ntpd.


    A further point: one of the things ntpd does to start as a background
    daemon is to fork, and the parent then exits. So the process that is
    initially started disappears very quickly. This should be visible in
    the syslog, as the PID associated with the initial version message will
    be different from any later messages. The DNS-lookup sub-fork happens
    after this fork. Doesn't necessarily explain what you saw, though.

    --
    Ronan Flood
    working for but not speaking for
    Network Services, University of London Computer Centre
    (which means: don't bother ULCC if I've said something you don't like)

  15. Re: Multiple ntp processes?

    In article david@djwhome.demon.co.uk
    (David Woolley) writes:
    >In article , per@hedeland.org (Per Hedeland) wrote:
    >
    >> .... and (last but not certainly not least) discipline the local clock
    >> based on the saved drift value.

    >
    >Although that doesn't apply on Unix systems using the kernel time discipline,
    >or, as far as I know, on Windows NT, as the frequency correction is locked into
    >the kernel by a single call.


    Well, I guess it would still apply at boot (which is the typical case of
    running the forked-off DNS resolver for people that don't constantly
    tinker with their NTP setup:-), i.e. ntpd needs to pass the info to the
    kernel at that point, right?

    >One reason for needing the separate process is that the traditional
    >implementation of the DNS resolver API in Unix is a blocking library
    >routine.


    Of course - that's the only reason AFAIK (plans for ntpd to use an async
    resolver was already mentioned in the thread I believe).

    --Per Hedeland
    per@hedeland.org


  16. Re: Multiple ntp processes?

    In article <45353090.2000109@mindspring.com> floess@mindspring.com (Scot
    P. Floess) writes:
    >This appears to be specific to sshd. I found some information someplace
    >(can't remember where) that stated something about sshd/ntpd... The
    >timing appears to be related to UTC versus my local time. Of course, I
    >lost the link and can't elaborate more
    >
    >But sure enough, the odd timings show current time and then current time
    >minus a few hours. I can reproduce this by simply tailing
    >/var/log/messages...and in an xterm ssh to my box...the timing comes out
    >odd as described...


    It's probably the result of the TZ environment variable getting
    set/changed at some point in the ssh login (which these days is normally
    pretty complex process-wise due to the "privilege separation" used -
    there is a "main" sshd daemon running as root as usual, but a
    non-privileged sshd process runs the protocol handshake, and then there
    is another sshd process that runs as the logged-in user...). Anyway
    nothing to do with ntpd, as already established.

    --Per Hedeland
    per@hedeland.org

+ Reply to Thread