how to check if NTP adjusted system time on Linux?

Question

I have a machine that experienced some troubles with some of the real time stuff that I'm running. One lead that I have is that NTP daemon may have moved the time, causing false timeouts.

How do I find out if NTP daemon did indeed move time at all? Any logs? I do see NTP daemon restart in /var/log/messages, but I don't know if time adjustment should be there as well.

to clarify: I need to understand it from the logs, after the event. May be 2 days after the time was adjusted. Running commands to see the current status doesn't help.

Answer 1

You can use ntpdc -c sysinfo command for querying ntpd status. It returns an output similar to this:

system peer:          0.0.0.0
system peer mode:     unspec
leap indicator:       11
stratum:              16
precision:            -20
root distance:        0.00000 s
root dispersion:      338.44917 s
reference ID:         [73.78.73.84]
reference time:       00000000.00000000  Thu, Feb  7 2036  8:28:16.000
system flags:         auth monitor ntp kernel stats
jitter:               0.000000 s
stability:            0.000 ppm
broadcastdelay:       0.003998 s
authdelay:            0.000000 s

Answer 2

The driftfile (/var/lib/ntp/drift) does not measure the difference between the local time and the time calculated by ntpd based on time servers contacted.

Instead it is the estimated drift (frequency error) of the local clock (in ppm). This value is updated by ntpd once an hour and does not decrease over time.

As far as I can tell the value is used by ntpd after a reboot to estimate how wrong the local clock is (the local clock runs even when the machine is powered off).

Example: Content of the file: 5 Machine was powered down 1 day (86400 s) 5 ppm of 86400 is 0.432 => The local clock is 0.432 s "in the future"

The points are: - ntpd can now apply a first approximate correction to the local time (-0.432 s) immediately after starting - ntpd knows immediately, how wrong the local clock is (in this example: 5 ppm)

(I am not allowed to comment on the comment of Sirex so I added a new comment)

Answer 3

you should have a value in the drift file. Its location will be in your /etc/ntp.conf

e.g: "driftfile /var/lib/ntp/drift"

this file is used to log how far your clock is from what it should be, and slowly ntp should lower this value as time progresses. - It wont do it in one go because that could cause timestamping issues on the system.

Answer 4

ntpq -nc peers will show you your syncronization status with all peers.

Answer 5

Sorry this is an old thread - hope I haven't broken a rule here :)

In /etc/ntp.conf, I have a line which looks like this:

#statsdir /var/log/ntpstats/

The description says to uncomment this line to log statistics. I've only just set up ntp on our server, so I'm not sure what it logs, but I ended up here looking for the same information, so hopefully this will help someone else.