The local time on each box with this erroe is so far off your source that it ntpd doesn't want to adjust it. Run ntpdate once on each box and you should be fine from there on in. ntpdate will make the big adjustment that is needed.
On Tue, Feb 28, 2012 at 8:47 AM, jjj092353 <[email protected]> wrote: > I have ossec running on abour 20 linux boxes and only one of the boxes > (they're all Centos 5.4 or higher) throws this error. > > I sometimes get this error every 10 minutes. How do I change the > parameter to stop the errors or solve the root problem? > > thanks in advance - Jeff > > OSSEC HIDS Notification. > 2012 Feb 27 21:15:21 > > Received From: (dot210) 65.36.241.210->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the > system." > Portion of the log(s): > > Feb 27 23:10:19 mysite ntpd[2148]: frequency error -512 PPM exceeds > tolerance 500 PPM > > > > --END OF NOTIFICATION
