[ntp:questions] Re: Multiple ntp processes?

Scot P. Floess floess at mindspring.com
Tue Oct 17 19:35:44 UTC 2006

This appears to be specific to sshd.  I found some information someplace 
(can't remember where) that stated something about sshd/ntpd...  The 
timing appears to be related to UTC versus my local time.  Of course, I 
lost the link and can't elaborate more :(

But sure enough, the odd timings show current time and then current time 
minus a few hours.  I can reproduce this by simply tailing 
/var/log/messages...and in an xterm ssh to my box...the timing comes out 
odd as described...

Scot P. Floess wrote:
> Richard:
> I just built the latest point release of NTP and it seems to have 
> fixed my problem.  What is really strange is the same script, same 
> rc3.d setup and the old version had 2 ntpd processes running...now 
> with the new version (no changes other than a recompile with the new 
> source) fixed the problem.  Someone responded to my post and stated 
> that it was normal behavior to see 2 versions running...that one was 
> for DNS lookup and would exit once it's job was complete.  What struck 
> me as odd was that in the past on single processor machines, I never 
> noticed more than one ntpd running.  It was only when I had moved over 
> to a dual PIII box that I would see 2 ntpd's running.  As I mentioned 
> in my post, the PPID of one of the ntpd's was the initially started ntpd.
> However, since I am now using the latest point release all seems better.
> On a side note, I still see in /var/log/messages odd intertwined 
> timings in logs.  For instance executing this:
> grep sshd /var/log/messages | grep Failed
> yields this:
> Oct 16 01:30:36 adminserver sshd[9271]: Failed password for invalid 
> user tester from port 49310 ssh2
> Oct 15 21:30:41 adminserver sshd[9272]: Failed password for invalid 
> user tester from port 50927 ssh2
> Oct 16 01:30:41 adminserver sshd[9273]: Failed password for invalid 
> user tester from port 50927 ssh2
> Oct 15 21:30:46 adminserver sshd[9274]: Failed password for invalid 
> user tester from port 52044 ssh2
> Oct 16 01:30:46 adminserver sshd[9276]: Failed password for invalid 
> user tester from port 52044 ssh2
> Oct 15 21:30:52 adminserver sshd[9277]: Failed password for invalid 
> user tester from port 54651 ssh2
> Oct 16 01:30:52 adminserver sshd[9278]: Failed password for invalid 
> user tester from port 54651 ssh2
> Oct 15 21:31:00 adminserver sshd[9279]: Failed password for invalid 
> user tester from port 56614 ssh2
> Note the timestamps...  So, this started me down the whole "I have 2 
> ntpd's running" issue.  It felt like maybe one was trying set the date 
> incorrectly...
> Thanks for your response!
> Scot
> Richard B. Gilbert wrote:
>> Scot P. Floess wrote:
>>> I didn't readily find an answer to this problem...
>>> I note when I start ntp as an init script running Fedora Core 5 on a 
>>> dual PIII 450 Mhz box, I see two ntpd processes running.  By looking 
>>> at the PID and PPID it appears one ntpd is starting the other.  I 
>>> note in /var/log/messages I will see logs with intermixed times.  
>>> For instance, a log with time X followed by logs with X - some prior 
>>> time...it's very odd...
>>> If, on the command line, I stop ntpd both processes stop fine.  By 
>>> starting ntpd again...I note only one ntpd process running.
>>> My question is:  is this behavior normal on a dual processor box?  
>>> Based on the odd timestamps in /var/log/messages - I would have to 
>>> say only one ntpd should be running...it almost "feels" like the two 
>>> ntpd's are fighting to set the system clock.
>>> Thanks in advance!
>>> Scot        
>> Only one instance of ntpd is supposed to be running.  Something about 
>> the way you are starting your system is starting two processes.  The 
>> most likely cause is executing the ntpd startup script twice.  If you 
>> add:
>> echo "Starting ntpd at `date`"
>> to the script that starts ntpd, you will see the message twice during 
>> startup if that is your problem.  I can't imagine what else it might 
>> be so, if it is something else, please let us know.
>> _______________________________________________
>> questions mailing list
>> questions at lists.ntp.isc.org
>> https://lists.ntp.isc.org/mailman/listinfo/questions

Scot P. Floess
27 Lake Royale
Louisburg, NC  27549

252-478-8087 (Home)
919-754-4592 (Work)

Chief Architect JPlate  http://sourceforge.net/projects/jplate
Chief Architect JavaPIM http://sourceforge.net/projects/javapim

More information about the questions mailing list