You should use nagios for this kind of checks. Eero 4.11.2015 6.08 ip. "Robert Micallef" <[email protected]> kirjoitti:
> Hi, > > I was wondering if anyone can help me configure a decoder and subsequently > an alert for when the NTP offset becomes too high. For security reasons I > had to configure a server to retrieve the time from outside and then all > other servers retrieve the time from this first server. The problems is > after a couple of months one or two servers will go out of sync by minutes. > I tried to resolve the issue but can't figure out why NTP sometimes doesn't > work well on some systems with basically the same configuration. So I am > close to giving up on NTP. > > Anyway I was wondering if I can create an alert then so I can manually fix > the problem when it happens. The problem is I don't know how to create a > decoder for this. The command ntpq -pn gives out the output: > > remote refid st t when poll reach delay offset > jitter > > ============================================================================== > 10.55.11.213 91.121.169.20 3 u 840 1024 0 0.765 -1972.3 > 0.000 > > Since the values change I don't know how to just get the offset and for > instance alert us if it is over 1500 like in this case. For instance the > poll is 840 now so 3 digits but will soon be 2 digits so I don't know how > to have a decoder for that. And some numbers might have decimal points at > one point and not have at another point. > > Another command which could work is ntpstat which gives the output: > synchronised to unspecified at stratum 4 > time correct to within 16875 ms > polling server every 1024 s > > This I could create a decoder for but the output is so inaccurate that > this is useless. > > Does anyone know how this can be done please? > > Thanks, > Robert > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
