Using ntpd for monitoring time drift, but not for adjusting

Question

I would want to use the common ntpd daemon to test whether time is kept by a virtual machine or not, without letting it actually adjust the clock.

I'm running Solaris 11.4 (Oracle's standard image for Intel) inside VirtualBox on a macOS system, and I can't get the time to synchronise properly. It struck me that the VM might well be using VirtualBox Guest Additions for doing this already (I don't know how this works) and that I might be upsetting the time keeping by running ntpd in the guest.

To test this, I thought I'd set up ntpd in in the Solaris VM to monitor a few public time servers, but somehow keep it from modifying the local clock. That way I could look at how the loopstats and peerstats logs looked over time to see whether the local clock actually kept good time.

The issue is that I can't find any hints about how to stop ntpd from adjusting the local clock.

I have wanted to do this in the past too on systems where I use openntpd (from OpenBSD) for actual time keeping. The ntpd daemon could then just sit in the background and monitor, without interfering. But I could not find any way to achieve this then either.

Answer 1

ntpd

Understanding that you must use ntpd, the only options AFAIK are:

disable ntp

As seen on the ntp.conf manual page there is the possibility of disabling the ntp feedback loop, or, in layman terms: remove the ability of calculating time corrections between time servers and the local clock. The ntp.conf line needed to activate such option is:

disable ntp

Note: when using this option the time that ntpd may give to other systems asking for a time reference could be wrong/off. Seems reasonable to use a line of deny to deny all queries for time from other systems unless you want to monitor time drift from an external system (use deny and allow the IP of the external system).

Note: It is not completely clear to me that the system clock is actually left to "run free" by ntpd. However, it is a documented option, so if ntpd fails to comply with what is documented it is a bug.

minsane

minsane minsane
This is the minimum number of candidates available to the clock selection algorithm in order to produce one or more truechimers for the clustering algorithm. If fewer than this number are available, the clock is undisciplined and allowed to run free.

This is done by setting a line ( in ntp.conf) like:

tos minsane 100

Or some other high number (bigger than the servers available or used).

Note: it is not clear to me that the kernel drift value is reset to 0 to avoid that the clock slowly shifts in value. May be reasonable to additionally set the disable kernel to disable kernel discipline functions.

Related

ntpd -qn

When a ntpd server is running ntpq -pn could report how well the ntpd server is doing its job of keeping the system clock in sync. That is an alternative way to log the time difference.

ntpdate -q

The package ntpdate (which is tagged as deprecated) may be used to check the time difference with:

ntpdate -q 'pool.ntp.org'         # marked as deprecated.

Use ntpdate -qu 'pool.ntp.org' so the command doesn't need root privileges to run (-u means "use unprivileged network ports", still, the executable has to be accessible to the user).

sntp

There is a simple program to query (not change if no -s or -S option is used):

sntp pool.ntp.org

rdate

The program rdate is able to show remote time (and local time):

rdate -np pool.ntp.org; date

Where -n means: Use SNTP (RFC 2030) instead of the (default) RFC 868 time protocol; and, to only print the result without making any actual changes.

However, this program is limited to a resolution of whole seconds (not fractions). And, it has no options in solaris

chrony

The replacement package of ntp (chrony) is able to execute a test of time difference without setting the system clock:

chronyd -Q 'pool pool.ntp.org iburst'

I believe that those are all methods to detect (without changing) the time difference between internet ntp time and system time.

Answer 2

I doubt this is possible with ntpd out of the box:

• At it's heart ntpd does not keep a "third" clock. (Where the first two are the system clock and monotonic clock).
• Functionally ntpd is writtent to make adjustments not only to the current time, but also adjust parameters controlling the system clock's run speed. Implicitly it is written to monitor the effect of these adjustments.

Putting these two togeather, it's highly unlikely that ntpd has a mode which can properly maintain values for these parameters without making real-time adjustments to a clock, where the only clock available to it is the system clock.

---

In your question it's not clear that you actually need ntpd. Any [S]NTP client would do.

If you're comfortable with a little bit of code then you might be able to put something togeather which would poll servers for you without recalibrating the system clock.

As an example, there is an NTP library for python called ntplib. A script to print out the offset on a 60 second poll might look like this:

import ntplib
import sys
import time

def main(*args):
    ntp_client = ntplib.NTPClient()
    while True:
        for server in args:
            try:
                response = ntp_client.request(server, version=3)
                print(response.offset)
                time.sleep(60)
            except ntplib.NTPException:
                print("query failed: {}".format(server))

if __name__ == "__main__":
    if len(sys.argv) == 1:
        # Do not use this server for commertial software without permission
        main('pool.ntp.org')
    else:
        main(sys.argv[1:])

Put this in a file ntp_check.py. Make sure that you have ntplib installed with either pip install ntplib or distrebutions specific (apt-get install python3-ntplib). Then call it with:

python3 ntp_check.py