8

We have a couple of virtual interfaces configured on eth0 on a CentOS, and every now and then, they went down seemingly out of the blue. Now after going through the log files, I found out that apparently ntpd deletes all eth0 interfaces, and that dhclient automatically brings eth0 back up. The virtual interfaces, however, stay down which causes several of our websites to be inaccessible.

Can someone explain to me why ntpd deletes interfaces? Can / should that be turned off, or can / should I configure dhclient to bring the virtual interfaces back up automatically, too?

EDIT// The log files that I should've posted : 

Nov 12 13:10:28 raptor dhclient[20048]: DHCPREQUEST on eth0 to 255.255.255.255 port 67 (xid=0x6a825e97)
Nov 12 13:10:42 raptor dhclient[20048]: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 8 (xid=0x24554092)
Nov 12 13:10:42 raptor dhclient[20048]: DHCPOFFER from 96.126.108.78
Nov 12 13:10:42 raptor dhclient[20048]: DHCPREQUEST on eth0 to 255.255.255.255 port 67 (xid=0x24554092)
Nov 12 13:10:42 raptor dhclient[20048]: DHCPACK from 96.126.108.78 (xid=0x24554092)
Nov 12 13:10:42 raptor ntpd[2109]: Deleting interface #31 eth0, 50.116.50.97#123, interface stats: received=3255, sent=3256, dropped=0, active_time=1559394 secs
Nov 12 13:10:42 raptor ntpd[2109]: Deleting interface #32 eth0:0, 50.116.53.56#123, interface stats: received=3, sent=0, dropped=0, active_time=1559391 secs
Nov 12 13:10:42 raptor ntpd[2109]: Deleting interface #33 eth0:1, 66.175.211.192#123, interface stats: received=2, sent=0, dropped=0, active_time=1559389 secs
Nov 12 13:10:42 raptor ntpd[2109]: Deleting interface #34 eth0:2, 50.116.53.95#123, interface stats: received=3, sent=0, dropped=0, active_time=1559387 secs
Nov 12 13:10:42 raptor ntpd[2109]: Deleting interface #35 eth0:3, 97.107.132.32#123, interface stats: received=2, sent=0, dropped=0, active_time=1559385 secs
Nov 12 13:10:42 raptor ntpd[2109]: Deleting interface #36 eth0:4, 50.116.56.201#123, interface stats: received=2, sent=0, dropped=0, active_time=1559383 secs
Nov 12 13:10:42 raptor ntpd[2109]: Deleting interface #37 eth0:5, 66.175.212.121#123, interface stats: received=2, sent=0, dropped=0, active_time=1559381 secs
Nov 12 13:10:42 raptor ntpd[2109]: Deleting interface #38 eth0:6, 66.175.215.137#123, interface stats: received=2, sent=0, dropped=0, active_time=1559379 secs
Nov 12 13:10:44 raptor NET[1573]: /sbin/dhclient-script : updated /etc/resolv.conf
Nov 12 13:10:44 raptor dhclient[20048]: bound to 50.116.50.97 -- renewal in 32692 seconds.
Nov 12 13:10:45 raptor ntpd[2109]: Listening on interface #39 eth0, 50.116.50.97#123 Enabled

The eth0 config :

DEVICE="eth0"
ONBOOT="yes"
BOOTPROTO="dhcp"
IPV6INIT="no"
IPADDR=50.116.50.97
NETMASK=255.255.255.0
GATEWAY=50.116.50.1

And the virtual interfaces (I posted the first one only, they look the same for the most part) :

# Configuration for eth0:0
DEVICE=eth0:0
BOOTPROTO=none

# This line ensures that the interface will be brought up during boot.
ONBOOT=yes

# eth0:0
IPADDR=50.116.53.56
NETMASK=255.255.255.0
Aurelin
  • 329
  • 2
  • 4
  • 10
  • 1
    What you are describing is very difficult to believe. ntpd shouldn't doing anything to bring you network interfaces down. Please elaborate on where you found this? I think you are miss-reading your logs or something. I think what you are seeing from NTP is an effect of whatever is bringing your interfaces down. I highly doubt ntp is the cause. It might be useful if you posted your network configuration as well. I am a bit confused by what you mean by `all eth0 interfaces` are you suing virtual interfaces? Have you tried assigning some static addresses in addition to dhcp? – Zoredache Nov 12 '13 at 20:19
  • Could you include the relevant logs which brought you to this conclusion? Seems unlikely, but seeing it would help with suspension of disbelief. – Aaron Copley Nov 12 '13 at 20:20
  • 1
    I have never run across an instance of ntpd removing an interface. ntpd will 'delete' an interface from its own running configuration should the underlying interface go away... ntpd also wouldn't know how to start dhclient. Perhaps you are manually adding virtual interfaces to an interface controlled by dhclient and dhclient is properly requesting a lease when the old one has expired. –  Nov 12 '13 at 20:21
  • Sure, sorry I completely forgot. I edited the logs and configs in. Zoredache, by "all eth0 interfaces" I meant eth0 and attached virtual interfaces (eth0:0 - eth0:6). The virtual interfaces have static interfaces, and as far as I know, so does eth0.. But I am not sure. I don't know this server too well, to be honest. So if it is not ntpd, what could it be then? The only thing going on before the interfaces went down were dhcp requests. The interfaces went down around 13:11/13:12, or that is when pingdom couldn't reach the sites anymore. – Aurelin Nov 12 '13 at 20:32

2 Answers2

6

The BOOTPROTO="dhcp" means you have DHCP.

If you look, the DHCP client is running immediately before ntp changes anything. I think your DHCP client is removing all the static addresses on eth0. When NTP notices this it knows that it needs to stop listening on all the sockets it was listening on for the static addresses.

Zoredache
  • 128,755
  • 40
  • 271
  • 413
  • What can I do? Can I just change BOOTPROTO to none since IPADDR is set? – Aurelin Nov 12 '13 at 20:38
  • `BOOTPROTO=none` is what I see in the [manual](http://www.centos.org/docs/5/html/Deployment_Guide-en-US/s1-networkscripts-interfaces.html). I suspect that should work. – Zoredache Nov 12 '13 at 20:39
  • 1
    Related question if you are wondering why NTP individually opens sockets for each individually assigned IP.http://serverfault.com/a/462706/984 – Zoredache Nov 12 '13 at 20:41
  • I changed it and restarted the interface and that seems to work. Hopefully that was the issue. Thanks (also for the follow up info)! – Aurelin Nov 12 '13 at 20:45
2

Issue

ntpd is deleting interfaces

Nov  9 01:10:09 localhost ntpd[27847]: Deleting interface #16 ethX, x.x.x.x#123, interface stats: received=0, sent=0, dropped=0, active_time=522 secs
Nov  9 01:10:09 localhost ntpd[27847]: Deleting interface #17 ethX, x.x.x.x#123, interface stats: received=0, sent=0, dropped=0, active_time=522 secs

Resolution

Use the -L option to tell ntpd to not listen on virtual interfaces. You can set -L in /etc/sysconfig/ntpd.

When the interface is down or removed, ntpd updates the listen interface according to the current interface status.

Source: https://access.redhat.com/solutions/261123

Sergio Rodrigues
  • 121
  • 3
  • Note tha ntpd is NOT deleting the interfaces! On that url it says "These messages are a reaction to interfaces being added and removed within the underlying networking stack. The NTP service does not itself add or removed networking interfaces." – gaoithe Jun 27 '19 at 11:24