On Nov 4, 2015 11:08 AM, "Robert Micallef" <[email protected]> wrote: > > Hi, > > I was wondering if anyone can help me configure a decoder and subsequently an alert for when the NTP offset becomes too high. For security reasons I had to configure a server to retrieve the time from outside and then all other servers retrieve the time from this first server. The problems is after a couple of months one or two servers will go out of sync by minutes. I tried to resolve the issue but can't figure out why NTP sometimes doesn't work well on some systems with basically the same configuration. So I am close to giving up on NTP. > > Anyway I was wondering if I can create an alert then so I can manually fix the problem when it happens. The problem is I don't know how to create a decoder for this. The command ntpq -pn gives out the output: > > remote refid st t when poll reach delay offset jitter > ============================================================================== > 10.55.11.213 91.121.169.20 3 u 840 1024 0 0.765 -1972.3 0.000 > > Since the values change I don't know how to just get the offset and for instance alert us if it is over 1500 like in this case. For instance the poll is 840 now so 3 digits but will soon be 2 digits so I don't know how to have a decoder for that. And some numbers might have decimal points at one point and not have at another point. >
There's no real way to do greater than or less than comparisons in ossec. > Another command which could work is ntpstat which gives the output: > synchronised to unspecified at stratum 4 > time correct to within 16875 ms > polling server every 1024 s > > This I could create a decoder for but the output is so inaccurate that this is useless. > > Does anyone know how this can be done please? > > Thanks, > Robert > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
