Hi,
I was wondering if anyone can help me configure a decoder and subsequently
an alert for when the NTP offset becomes too high. For security reasons I
had to configure a server to retrieve the time from outside and then all
other servers retrieve the time from this first server. The problems is
after a couple of months one or two servers will go out of sync by minutes.
I tried to resolve the issue but can't figure out why NTP sometimes doesn't
work well on some systems with basically the same configuration. So I am
close to giving up on NTP.
Anyway I was wondering if I can create an alert then so I can manually fix
the problem when it happens. The problem is I don't know how to create a
decoder for this. The command ntpq -pn gives out the output:
remote refid st t when poll reach delay offset
jitter
==============================================================================
10.55.11.213 91.121.169.20 3 u 840 1024 0 0.765 -1972.3
0.000
Since the values change I don't know how to just get the offset and for
instance alert us if it is over 1500 like in this case. For instance the
poll is 840 now so 3 digits but will soon be 2 digits so I don't know how
to have a decoder for that. And some numbers might have decimal points at
one point and not have at another point.
Another command which could work is ntpstat which gives the output:
synchronised to unspecified at stratum 4
time correct to within 16875 ms
polling server every 1024 s
This I could create a decoder for but the output is so inaccurate that this
is useless.
Does anyone know how this can be done please?
Thanks,
Robert
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
