{ "content": [ { "type": "text", "text": "# ntpd (man)\n\n## NAME\n\nntpd - Network Time Protocol service daemon\n\n## SYNOPSIS\n\nntpd\n[-46agGhLmnNqx] [assert] [-c conffile] [-f driftfile]\n[-i jaildir] [-k keyfile] [-l logfile] [-p pidfile]\n[-P priority] [-s statsdir] [-t key]\n[-u user[:'group']] [-U interfaceupdateinterval]\n[-v variable] [-V variable] [server...]\n\n## DESCRIPTION\n\nThe ntpd utility is an operating system daemon which sets and maintains the system time of\nday in synchronism with Internet standard time servers. It is a complete implementation of\nthe Network Time Protocol (NTP) version 4, as defined by RFC 5905, but also retains\ncompatibility with version 3, as defined by RFC 1305, and versions 1 and 2, as defined by RFC\n1059 and RFC 1119, respectively.\n\n## TLDR\n\n> The official NTP (Network Time Protocol) daemon to synchronize the system clock to remote time servers or local reference clocks.\n\n- Start the daemon:\n `sudo ntpd`\n- Synchronize system time with remote servers a single time (quit after synchronizing):\n `sudo ntpd --quit`\n- Synchronize a single time allowing \"Big\" adjustments:\n `sudo ntpd --panicgate --quit`\n\n*Source: tldr-pages*\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION**\n- **OPTIONS** (12 subsections)\n- **USAGE** (6 subsections)\n- **FILES**\n- **SIGNALS**\n- **BUGS**\n- **STANDARDS**\n- **EXIT STATUS**\n- **SEE ALSO**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "ntpd", "section": "", "mode": "man", "summary": "ntpd - Network Time Protocol service daemon", "synopsis": "ntpd\n[-46agGhLmnNqx] [assert] [-c conffile] [-f driftfile]\n[-i jaildir] [-k keyfile] [-l logfile] [-p pidfile]\n[-P priority] [-s statsdir] [-t key]\n[-u user[:'group']] [-U interfaceupdateinterval]\n[-v variable] [-V variable] [server...]", "tldr_summary": "The official NTP (Network Time Protocol) daemon to synchronize the system clock to remote time servers or local reference clocks.", "tldr_examples": [ { "description": "Start the daemon", "command": "sudo ntpd" }, { "description": "Synchronize system time with remote servers a single time (quit after synchronizing)", "command": "sudo ntpd --quit" }, { "description": "Synchronize a single time allowing \"Big\" adjustments", "command": "sudo ntpd --panicgate --quit" } ], "tldr_source": "official", "flags": [ { "flag": "-a", "long": "--assert", "arg": null, "description": "REQUIRE(false) to test assert handler. -c string, --configfile=string configuration file name. The name and path of the configuration file, /etc/ntp.conf by default." }, { "flag": "-d", "long": "--debug-level", "arg": null, "description": "Increase debug verbosity level. This option may appear an unlimited number of times. -D number, --set-debug-level=number Set the debug verbosity level. This option may appear an unlimited number of times. This option takes an integer number as its argument. -f string, --driftfile=string frequency drift file name. The name and path of the frequency file, e.g. /var/lib/ntpsec/ntp.drift. This is the same operation as the driftfile configuration specification in the /etc/ntp.conf file." }, { "flag": "-g", "long": "--panicgate", "arg": null, "description": "Allow the first adjustment to be big. This option may appear an unlimited number of times. Normally, ntpd exits with a message to the system log if the offset exceeds the panic threshold, which is 1000 s by default. This option allows the time to be set to any value without restriction; however, this can happen only once. If the threshold is exceeded after that, ntpd will exit with a message to the system log. This option can be used with the -q and -x options. See the tinker configuration file directive for other options." }, { "flag": "-G", "long": null, "arg": null, "description": "Step any initial offset correction. Normally, ntpd steps the time if the time offset exceeds the step threshold, which is 128 ms by default, and otherwise slews the time. This option forces the initial offset correction to be stepped, so the highest time accuracy can be achieved quickly. However, this may also cause the time to be stepped back so this option must not be used if applications requiring monotonic time are running. See the tinker configuration file directive for other options." }, { "flag": "-h", "long": "--help", "arg": null, "description": "Print a usage message summarizing options and exit. -i string, --jaildir=string Jail directory. Chroot the server to the directory jaildir This option also implies that the server attempts to drop root privileges at startup. You may need to also specify a -u option. This option is only available if the OS supports adjusting the clock without full root privileges. This option is supported under Linux, NetBSD, and Solaris. -I iface, --interface=iface Listen on an interface name or address. This option may appear an unlimited number of times. Open the network address given, or all the addresses associated with the given interface name. This option may appear multiple times. This option also implies not opening other addresses, except wildcard and localhost. This option is deprecated. Please consider using the configuration file interface command, which is more versatile. -k string, --keyfile=string the path to symmetric keys. Specify the name and path of the symmetric key file. /etc/ntpsec/ntp.keys is the default location. This is the same operation as the keys configuration file directive. -l string, --logfile=string the path to the log file. Specify the name and path of the log file. The default is the system log file. This is the same operation as the logfile configuration file directive. See ntp.conf(5) for more info." }, { "flag": "-L", "long": "--novirtualips", "arg": null, "description": "Do not listen to virtual interfaces. Do not listen to virtual interfaces, defined as those with names containing a colon. This option is deprecated. Please consider using the configuration file interface command, which is more versatile." }, { "flag": "-m", "long": "--mdns", "arg": null, "description": "Register with mDNS as an NTP server. Registers as an NTP server with the local mDNS server which allows the server to be discovered via mDNS client lookup." }, { "flag": "-n", "long": "--nofork", "arg": null, "description": "Do not fork. This option must not appear in combination with any of the following options: wait-sync." }, { "flag": "-N", "long": "--nice", "arg": null, "description": "Run at high priority. To the extent permitted by the operating system, run ntpd at the highest priority. -p string, --pidfile=string the path to the PID file. Specify the name and path of the file used to record ntpd's process ID. This is the same operation as the pidfile configuration file directive. -P number, --priority=number Process priority. This option takes an integer number as its argument. To the extent permitted by the operating system, run ntpd at the specified pthreadsetschedparam(SCHEDFIFO) priority." }, { "flag": "-q", "long": "--quit", "arg": null, "description": "Set the time and quit. This option must not appear in combination with wait-sync. ntpd will not daemonize and will exit after the clock is first synchronized. This behavior mimics that of the old ntpdate program, which has been replaced with a shell script. The -g and -x options can be used with this option. Note: The kernel time discipline is disabled with this option. -s string, --statsdir=string Statistics file location. Specify the directory path for files created by the statistics facility. This is the same operation as the statsdir configuration file directive. -t tkey, --trustedkey=tkey Trusted key number. This option may appear an unlimited number of times. Add the specified key number to the trusted key list. -u string, --user=string Run as userid (or userid:groupid). Specify a user, and optionally a group, to switch to. The user and group may be specified by name or numeric id. If no group is specified, then the default group for userid is used. This option is only available if the OS supports adjusting the clock without full root privileges. This option is supported under Linux, NetBSD, Solaris and other OS. -U number, --updateinterval=number interval in seconds between scans for new or dropped interfaces. This option takes an integer number as its argument. Give the time in seconds between two scans for new or dropped interfaces. For systems with routing socket support, the scans will be performed shortly after the interface change has been detected by the system. Use 0 to disable scanning. 60 seconds is the minimum time between scans. -w number, --wait-sync=number Seconds to wait for first clock sync. This option must not appear in combination with any of the following options: nofork, quit. This option takes an integer number as its argument. If greater than zero alters ntpd's behavior when forking to daemonize. Instead of exiting with status 0 immediately after the fork, the parent waits up to the specified number of seconds for the child to first synchronize the clock. The exit status is zero (success) if the clock was synchronized; otherwise, it is ETIMEDOUT. This provides the option for a script starting ntpd to easily wait for the first set of the clock before proceeding." }, { "flag": "-x", "long": "--slew", "arg": null, "description": "Slew up to 600 seconds. Normally, the time is slewed if the offset is less than the step threshold, which is 128 ms by default, and stepped if above the threshold. This option sets the threshold to 600 s, which is well within the accuracy window to set the clock manually. Note: Since the slew rate of typical Unix kernels is limited to 0.5 ms/s, each second of adjustment requires an amortization interval of 2000 s. Thus, an adjustment as much as 600 s will take almost 14 days to complete. This option can be used with the -g and -q options. See the tinker configuration file directive for other options. Note: The kernel time discipline is disabled with this option. -z nvar, --var=nvar make ARG an ntp variable (RW). This option may appear an unlimited number of times. -Z nvar, --dvar=ndvar make ARG an ntp variable (RW|DEF). This option may appear an unlimited number of times." }, { "flag": "-V", "long": "--version", "arg": null, "description": "Output version of program and exit. Any arguments given after options are interpreted as server addresses or hostnames, with the iburst option implied. Associations with these are formed before any associations implied by the configuration file." } ], "examples": [], "see_also": [ { "name": "ntp.conf", "section": "5", "url": "https://www.chedong.com/phpMan.php/man/ntp.conf/5/json" }, { "name": "ntpq", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/ntpq/1/json" }, { "name": "ntpdig", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/ntpdig/1/json" } ], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "SYNOPSIS", "lines": 7, "subsections": [] }, { "name": "DESCRIPTION", "lines": 30, "subsections": [] }, { "name": "OPTIONS", "lines": 12, "subsections": [ { "name": "-a, --assert", "lines": 7, "flag": "-a", "long": "--assert" }, { "name": "-d, --debug-level", "lines": 12, "flag": "-d", "long": "--debug-level" }, { "name": "-g, --panicgate", "lines": 9, "flag": "-g", "long": "--panicgate" }, { "name": "-G", "lines": 9, "flag": "-G" }, { "name": "-h, --help", "lines": 32, "flag": "-h", "long": "--help" }, { "name": "-L, --novirtualips", "lines": 6, "flag": "-L", "long": "--novirtualips" }, { "name": "-m, --mdns", "lines": 5, "flag": "-m", "long": "--mdns" }, { "name": "-n, --nofork", "lines": 3, "flag": "-n", "long": "--nofork" }, { "name": "-N, --nice", "lines": 16, "flag": "-N", "long": "--nice" }, { "name": "-q, --quit", "lines": 46, "flag": "-q", "long": "--quit" }, { "name": "-x, --slew", "lines": 17, "flag": "-x", "long": "--slew" }, { "name": "-V, --version", "lines": 6, "flag": "-V", "long": "--version" } ] }, { "name": "USAGE", "lines": 1, "subsections": [ { "name": "How NTP Operates", "lines": 67 }, { "name": "Starting NTP (Best Current Practice)", "lines": 14 }, { "name": "Frequency Discipline", "lines": 11 }, { "name": "Operating Modes", "lines": 30 }, { "name": "Poll Interval Control", "lines": 24 }, { "name": "The huff-n'-puff Filter", "lines": 18 } ] }, { "name": "FILES", "lines": 47, "subsections": [] }, { "name": "SIGNALS", "lines": 20, "subsections": [] }, { "name": "BUGS", "lines": 3, "subsections": [] }, { "name": "STANDARDS", "lines": 21, "subsections": [] }, { "name": "EXIT STATUS", "lines": 8, "subsections": [] }, { "name": "SEE ALSO", "lines": 3, "subsections": [] } ], "sections": { "NAME": { "content": "ntpd - Network Time Protocol service daemon\n", "subsections": [] }, "SYNOPSIS": { "content": "ntpd\n[-46agGhLmnNqx] [assert] [-c conffile] [-f driftfile]\n[-i jaildir] [-k keyfile] [-l logfile] [-p pidfile]\n[-P priority] [-s statsdir] [-t key]\n[-u user[:'group']] [-U interfaceupdateinterval]\n[-v variable] [-V variable] [server...]\n", "subsections": [] }, "DESCRIPTION": { "content": "The ntpd utility is an operating system daemon which sets and maintains the system time of\nday in synchronism with Internet standard time servers. It is a complete implementation of\nthe Network Time Protocol (NTP) version 4, as defined by RFC 5905, but also retains\ncompatibility with version 3, as defined by RFC 1305, and versions 1 and 2, as defined by RFC\n1059 and RFC 1119, respectively.\n\nThe ntpd utility can synchronize time to a theoretical precision of about 232 picoseconds. In\npractice, this limit is unattainable due to quantum limits on the clock speed of\nballistic-electron logic.\n\nOrdinarily, ntpd reads the ntp.conf(5) configuration file at startup time in order to\ndetermine the synchronization sources and operating modes. It is also possible to specify a\nworking, although limited, configuration entirely on the command line, obviating the need for\na configuration file.\n\nThe ntpd program normally operates continuously while adjusting the system time and\nfrequency, but in some cases this might not be practical. With the -q option ntpd operates as\nin continuous mode, but exits just after setting the clock for the first time. Most\napplications will probably want to specify the iburst option with the server command. With\nthis option, a volley of messages is exchanged to groom the data and set the clock in about\nten seconds. With -q, if nothing is heard after a few minutes, the daemon times out and exits\nwithout setting the clock.\n\nVarious internal ntpd variables can be displayed and configuration options altered while the\nntpd is running using the ntpq(1) utility program. The state of ntpd can be continuously\nmonitored using ntpmon(1).\n\nWhen ntpd starts it looks at the value of umask(2), and if zero ntpd will set the umask(2) to\n022.\n", "subsections": [] }, "OPTIONS": { "content": "-4, --ipv4\nForce IPv4 DNS name resolution. This option must not appear in combination with any of\nthe following options: ipv6.\n\nForce DNS resolution of following host names on the command line to the IPv4 namespace.\n\n-6, --ipv6\nForce IPv6 DNS name resolution. This option must not appear in combination with any of\nthe following options: ipv4.\n\nForce DNS resolution of following host names on the command line to the IPv6 namespace.\n", "subsections": [ { "name": "-a, --assert", "content": "REQUIRE(false) to test assert handler.\n\n-c string, --configfile=string\nconfiguration file name.\n\nThe name and path of the configuration file, /etc/ntp.conf by default.\n", "flag": "-a", "long": "--assert" }, { "name": "-d, --debug-level", "content": "Increase debug verbosity level. This option may appear an unlimited number of times.\n\n-D number, --set-debug-level=number\nSet the debug verbosity level. This option may appear an unlimited number of times. This\noption takes an integer number as its argument.\n\n-f string, --driftfile=string\nfrequency drift file name.\n\nThe name and path of the frequency file, e.g. /var/lib/ntpsec/ntp.drift. This is the same\noperation as the driftfile configuration specification in the /etc/ntp.conf file.\n", "flag": "-d", "long": "--debug-level" }, { "name": "-g, --panicgate", "content": "Allow the first adjustment to be big. This option may appear an unlimited number of\ntimes.\n\nNormally, ntpd exits with a message to the system log if the offset exceeds the panic\nthreshold, which is 1000 s by default. This option allows the time to be set to any value\nwithout restriction; however, this can happen only once. If the threshold is exceeded\nafter that, ntpd will exit with a message to the system log. This option can be used with\nthe -q and -x options. See the tinker configuration file directive for other options.\n", "flag": "-g", "long": "--panicgate" }, { "name": "-G", "content": "Step any initial offset correction.\n\nNormally, ntpd steps the time if the time offset exceeds the step threshold, which is 128\nms by default, and otherwise slews the time. This option forces the initial offset\ncorrection to be stepped, so the highest time accuracy can be achieved quickly. However,\nthis may also cause the time to be stepped back so this option must not be used if\napplications requiring monotonic time are running. See the tinker configuration file\ndirective for other options.\n", "flag": "-G" }, { "name": "-h, --help", "content": "Print a usage message summarizing options and exit.\n\n-i string, --jaildir=string\nJail directory.\n\nChroot the server to the directory jaildir This option also implies that the server\nattempts to drop root privileges at startup. You may need to also specify a -u option.\nThis option is only available if the OS supports adjusting the clock without full root\nprivileges. This option is supported under Linux, NetBSD, and Solaris.\n\n-I iface, --interface=iface\nListen on an interface name or address. This option may appear an unlimited number of\ntimes.\n\nOpen the network address given, or all the addresses associated with the given interface\nname. This option may appear multiple times. This option also implies not opening other\naddresses, except wildcard and localhost. This option is deprecated. Please consider\nusing the configuration file interface command, which is more versatile.\n\n-k string, --keyfile=string\nthe path to symmetric keys.\n\nSpecify the name and path of the symmetric key file. /etc/ntpsec/ntp.keys is the default\nlocation. This is the same operation as the keys configuration file directive.\n\n-l string, --logfile=string\nthe path to the log file.\n\nSpecify the name and path of the log file. The default is the system log file. This is\nthe same operation as the logfile configuration file directive. See ntp.conf(5) for more\ninfo.\n", "flag": "-h", "long": "--help" }, { "name": "-L, --novirtualips", "content": "Do not listen to virtual interfaces.\n\nDo not listen to virtual interfaces, defined as those with names containing a colon. This\noption is deprecated. Please consider using the configuration file interface command,\nwhich is more versatile.\n", "flag": "-L", "long": "--novirtualips" }, { "name": "-m, --mdns", "content": "Register with mDNS as an NTP server.\n\nRegisters as an NTP server with the local mDNS server which allows the server to be\ndiscovered via mDNS client lookup.\n", "flag": "-m", "long": "--mdns" }, { "name": "-n, --nofork", "content": "Do not fork. This option must not appear in combination with any of the following\noptions: wait-sync.\n", "flag": "-n", "long": "--nofork" }, { "name": "-N, --nice", "content": "Run at high priority.\n\nTo the extent permitted by the operating system, run ntpd at the highest priority.\n\n-p string, --pidfile=string\nthe path to the PID file.\n\nSpecify the name and path of the file used to record ntpd's process ID. This is the same\noperation as the pidfile configuration file directive.\n\n-P number, --priority=number\nProcess priority. This option takes an integer number as its argument.\n\nTo the extent permitted by the operating system, run ntpd at the specified\npthreadsetschedparam(SCHEDFIFO) priority.\n", "flag": "-N", "long": "--nice" }, { "name": "-q, --quit", "content": "Set the time and quit. This option must not appear in combination with wait-sync.\n\nntpd will not daemonize and will exit after the clock is first synchronized. This\nbehavior mimics that of the old ntpdate program, which has been replaced with a shell\nscript. The -g and -x options can be used with this option. Note: The kernel time\ndiscipline is disabled with this option.\n\n-s string, --statsdir=string\nStatistics file location.\n\nSpecify the directory path for files created by the statistics facility. This is the same\noperation as the statsdir configuration file directive.\n\n-t tkey, --trustedkey=tkey\nTrusted key number. This option may appear an unlimited number of times.\n\nAdd the specified key number to the trusted key list.\n\n-u string, --user=string\nRun as userid (or userid:groupid).\n\nSpecify a user, and optionally a group, to switch to. The user and group may be specified\nby name or numeric id. If no group is specified, then the default group for userid is\nused. This option is only available if the OS supports adjusting the clock without full\nroot privileges. This option is supported under Linux, NetBSD, Solaris and other OS.\n\n-U number, --updateinterval=number\ninterval in seconds between scans for new or dropped interfaces. This option takes an\ninteger number as its argument.\n\nGive the time in seconds between two scans for new or dropped interfaces. For systems\nwith routing socket support, the scans will be performed shortly after the interface\nchange has been detected by the system. Use 0 to disable scanning. 60 seconds is the\nminimum time between scans.\n\n-w number, --wait-sync=number\nSeconds to wait for first clock sync. This option must not appear in combination with any\nof the following options: nofork, quit. This option takes an integer number as its\nargument.\n\nIf greater than zero alters ntpd's behavior when forking to daemonize. Instead of exiting\nwith status 0 immediately after the fork, the parent waits up to the specified number of\nseconds for the child to first synchronize the clock. The exit status is zero (success)\nif the clock was synchronized; otherwise, it is ETIMEDOUT. This provides the option for a\nscript starting ntpd to easily wait for the first set of the clock before proceeding.\n", "flag": "-q", "long": "--quit" }, { "name": "-x, --slew", "content": "Slew up to 600 seconds.\n\nNormally, the time is slewed if the offset is less than the step threshold, which is 128\nms by default, and stepped if above the threshold. This option sets the threshold to 600\ns, which is well within the accuracy window to set the clock manually. Note: Since the\nslew rate of typical Unix kernels is limited to 0.5 ms/s, each second of adjustment\nrequires an amortization interval of 2000 s. Thus, an adjustment as much as 600 s will\ntake almost 14 days to complete. This option can be used with the -g and -q options. See\nthe tinker configuration file directive for other options. Note: The kernel time\ndiscipline is disabled with this option.\n\n-z nvar, --var=nvar\nmake ARG an ntp variable (RW). This option may appear an unlimited number of times.\n\n-Z nvar, --dvar=ndvar\nmake ARG an ntp variable (RW|DEF). This option may appear an unlimited number of times.\n", "flag": "-x", "long": "--slew" }, { "name": "-V, --version", "content": "Output version of program and exit.\n\nAny arguments given after options are interpreted as server addresses or hostnames, with the\niburst option implied. Associations with these are formed before any associations implied by\nthe configuration file.\n", "flag": "-V", "long": "--version" } ] }, "USAGE": { "content": "", "subsections": [ { "name": "How NTP Operates", "content": "The ntpd utility operates by exchanging messages with one or more configured servers over a\nrange of designated poll intervals. When started, whether for the first or subsequent times,\nthe program requires several exchanges from the majority of these servers so the signal\nprocessing and mitigation algorithms can accumulate and groom the data and set the clock. In\norder to protect the network from bursts, the initial poll interval for each server is\ndelayed an interval randomized over a few seconds. At the default initial poll interval of\n64s, several minutes can elapse before the clock is set. This initial delay to set the clock\ncan be safely and dramatically reduced using the iburst keyword with the server configuration\ncommand, as described in ntp.conf(5).\n\nMost operating systems and hardware of today incorporate a time-of-year (TOY) chip to\nmaintain the time during periods when the power is off. When the machine is booted, the chip\nis used to initialize the operating system time. After the machine has synchronized to an NTP\nserver, the operating system corrects the chip from time to time. In the default case, if\nntpd detects that the time on the host is more than 1000s from the server time, ntpd assumes\nsomething must be terribly wrong, and the only reliable action is for the operator to\nintervene and set the clock by hand. (Reasons for this include there is no TOY chip, or its\nbattery is dead, or that the TOY chip is just of poor quality.) This causes ntpd to exit with\na panic message to the system log. The -g option overrides this check, and the clock will be\nset to the server time regardless of the chip time (up to 68 years in the past or future —\nthis is a limitation of the NTPv4 protocol). However, and to protect against broken hardware,\nsuch as when the CMOS battery fails or the clock counter becomes defective, once the clock\nhas been set an error greater than 1000s will cause ntpd to exit anyway.\n\nUnder ordinary conditions, ntpd adjusts the clock in small steps so that the timescale is\neffectively continuous and without discontinuities. Under conditions of extreme network\ncongestion, the roundtrip delay jitter can exceed three seconds and the synchronization\ndistance, which is equal to one-half the roundtrip delay plus error budget terms, can become\nvery large. The ntpd algorithms discard sample offsets exceeding 128 ms, unless the interval\nduring which no sample offset is less than 128 ms exceeds 900s. The first sample after that,\nno matter what the offset, steps the clock to the indicated time. In practice, this reduces\nthe false alarm rate where the clock is stepped in error to a vanishingly low incidence.\n\nAs the result of this behavior, once the clock has been set it very rarely strays more than\n128 ms even under extreme cases of network path congestion and jitter. Sometimes, in\nparticular, when ntpd is first started without a valid drift file on a system with a large\nintrinsic drift the error might grow to exceed 128 ms, which would cause the clock to be set\nbackwards if the local clock time is more than 128 ms in the future relative to the server.\nIn some applications, this behavior may be unacceptable. There are several solutions,\nhowever. If the -x option is included on the command line, the clock will never be stepped\nand only slew corrections will be used. But this choice comes at a cost that should be\ncarefully explored before deciding to use the -x option. The maximum slew rate possible is\nlimited to 500 parts-per-million (PPM) as a consequence of the correctness principles on\nwhich the NTP protocol and algorithm design are based. As a result, the local clock can take\na long time to converge to an acceptable offset, about 2,000 s for each second the clock is\noutside the acceptable range. During this interval, the local clock will not be consistent\nwith any other network clock and the system cannot be used for distributed applications that\nrequire correctly synchronized network time.\n\nIn spite of the above precautions, sometimes when large frequency errors are present the\nresulting time offsets stray outside the 128-ms range and an eventual step or slew time\ncorrection is required. If following such a correction the frequency error is so large that\nthe first sample is outside the acceptable range, ntpd enters the same state as when the\nntp.drift file is not present. The intent of this behavior is to quickly correct the\nfrequency and restore operation to the normal tracking mode. In the most extreme cases, there\nmay be occasional step/slew corrections and subsequent frequency corrections. It helps in\nthese cases to use the burst keyword when configuring the server, but ONLY when you have\npermission to do so from the owner of the target host.\n\nFinally, in the past, many startup scripts would run a separate utility to get the system\nclock close to correct before starting ntpd(8), but this was never more than a mediocre hack\nand is no longer needed. If you are following the \u001b[34mbest current practice \u001b[0m<#starting> and you\nstill need to set the system time before starting ntpd, please open a bug report and document\nwhat is going on, and then look at using ntpdig(1).\n\nThere is a way to start ntpd(8) that often addresses all of the problems mentioned above.\n" }, { "name": "Starting NTP (Best Current Practice)", "content": "First, use the iburst option on your server and pool entries.\n\nIf you can also keep a good ntp.drift file then ntpd(8) will effectively \"warm-start\" and\nyour system’s clock will be stable in under 11 seconds' time.\n\nAs soon as possible in the startup sequence, start ntpd(8) with at least the -g and perhaps\nthe -N options. Then, start the rest of your \"normal\" processes. This will give ntpd(8) as\nmuch time as possible to get the system’s clock synchronized and stable.\n\nFinally, if you have processes like dovecot or database servers that require\nmonotonically-increasing time, run ntpwait(8) as late as possible in the boot sequence\n(perhaps with the -v flag) and after ntpwait(8) exits successfully it is as safe as it will\never be to start any processes that require stable time.\n" }, { "name": "Frequency Discipline", "content": "The ntpd behavior at startup depends on whether the frequency file, usually ntp.drift,\nexists. This file contains the latest estimate of clock frequency error. When the ntpd is\nstarted and the file does not exist, the ntpd enters a special mode designed to quickly adapt\nto the particular system clock oscillator time and frequency error. This takes approximately\n15 minutes, after which the time and frequency are set to nominal values and the ntpd enters\nnormal mode, where the time and frequency are continuously tracked relative to the server.\nAfter one hour the frequency file is created and the current frequency offset written to it.\nWhen the ntpd is started and the file does exist, the ntpd frequency is initialized from the\nfile and enters normal mode immediately. After that, the current frequency offset is written\nto the file at hourly intervals.\n" }, { "name": "Operating Modes", "content": "ntpd normally operates continuously while monitoring for small changes in frequency and\ntrimming the clock for the ultimate precision. However, it can operate in a one-time mode\nwhere the time is set from an external server and frequency is set from a previously recorded\nfrequency file.\n\nBy default, ntpd runs in continuous mode where each of possibly several external servers is\npolled at intervals determined by an intricate state machine. The state machine measures the\nincidental roundtrip delay jitter and oscillator frequency wander and determines the best\npoll interval using a heuristic algorithm. Ordinarily, and in most operating environments,\nthe state machine will start with 64s intervals and eventually increase in steps to 1024s. A\nsmall amount of random variation is introduced in order to avoid bunching at the servers. In\naddition, should a server become unreachable for some time, the poll interval is increased in\nsteps to 1024s in order to reduce network overhead.\n\nIn some cases, it may not be practical for ntpd to run continuously. The -q option is\nprovided to support running ntpd periodically from a cron(8) job. Setting this option will\ncause ntpd to exit just after setting the clock for the first time. The procedure for\ninitially setting the clock is the same as in continuous mode; most applications will\nprobably want to specify the iburst keyword with the server configuration command. With this\nkeyword, a volley of messages are exchanged to groom the data and the clock is set in about\n10 sec. If nothing is heard after a couple of minutes, the daemon times out and exits.\n\nWhen kernel support is available to discipline the clock frequency, which is the case for\nstock Solaris, Linux, and FreeBSD, a useful feature is available to discipline the clock\nfrequency. First, ntpd is run in continuous mode with selected servers in order to measure\nand record the intrinsic clock frequency offset in the frequency file. It may take some hours\nfor the frequency and offset to settle down. Then the ntpd is stopped and run in one-time\nmode as required. At each startup, the frequency is read from the file and initializes the\nkernel frequency.\n" }, { "name": "Poll Interval Control", "content": "This version of NTP includes an intricate state machine to reduce the network load while\nmaintaining a quality of synchronization consistent with the observed jitter and wander.\nThere are a number of ways to tailor the operation in order enhance accuracy by reducing the\ninterval or to reduce network overhead by increasing it. However, the user is advised to\ncarefully consider the consequences of changing the poll adjustment range from the default\nminimum of 64 s to the default maximum of 1,024 s. The default minimum can be changed with\nthe tinker minpoll command to a value not less than 16 s. This value is used for all\nconfigured associations, unless overridden by the minpoll option on the configuration\ncommand. Note that most device drivers will not operate properly if the poll interval is less\nthan 64 s and that the broadcast server and manycast client associations will also use the\ndefault unless overridden.\n\nIn some cases involving dial up or toll services, it may be useful to increase the minimum\ninterval to a few tens of minutes and maximum interval to a day or so. Under normal operation\nconditions, once the clock discipline loop has stabilized the interval will be increased in\nsteps from the minimum to the maximum. However, this assumes the intrinsic clock frequency\nerror is small enough for the discipline loop correct it. The capture range of the loop is\n500 PPM at an interval of 64s decreasing by a factor of two for each doubling of the\ninterval. At a minimum of 1,024 s, for example, the capture range is only 31 PPM. If the\nintrinsic error is greater than this, the drift file ntp.drift will have to be specially\ntailored to reduce the residual error below this limit. Once this is done, the drift file is\nautomatically updated once per hour and is available to initialize the frequency on\nsubsequent daemon restarts.\n" }, { "name": "The huff-n'-puff Filter", "content": "In scenarios where a considerable amount of data are to be downloaded or uploaded over\ntelephone modems, timekeeping quality can be seriously degraded. This occurs because the\ndifferential delays on the two directions of transmission can be quite large. In many cases,\nthe apparent time errors are so large as to exceed the step threshold and a step correction\ncan occur during and after the data transfer is in progress.\n\nThe huff-n'-puff filter is designed to correct the apparent time offset in these cases. It\ndepends on knowledge of the propagation delay when no other traffic is present. In common\nscenarios, this occurs during other than work hours. The filter maintains a shift register\nthat remembers the minimum delay over the most recent interval measured usually in hours.\nUnder conditions of severe delay, the filter corrects the apparent offset using the sign of\nthe offset and the difference between the apparent delay and minimum delay. The name of the\nfilter reflects the negative (huff) and positive (puff) correction, which depends on the sign\nof the offset.\n\nThe filter is activated by the tinker command and huffpuff keyword, as described in\nntp.conf(5).\n" } ] }, "FILES": { "content": "┌────────────────────┬───────────────────┬────────┬─────────────┐\n│ │ │ │ │\n│ File │ Default │ Option │ Option │\n├────────────────────┼───────────────────┼────────┼─────────────┤\n│ │ │ │ │\n│ configuration file │ /etc/ntp.conf │ -c │ conffile │\n├────────────────────┼───────────────────┼────────┼─────────────┤\n│ │ │ │ │\n│ configuration │ /etc/ntpsec/ntp.d │ -c │ conffile │\n│ directory │ │ │ │\n├────────────────────┼───────────────────┼────────┼─────────────┤\n│ │ │ │ │\n│ frequency file │ none │ -f │ driftfile │\n├────────────────────┼───────────────────┼────────┼─────────────┤\n│ │ │ │ │\n│ leapseconds file │ none │ │ leapfile │\n├────────────────────┼───────────────────┼────────┼─────────────┤\n│ │ │ │ │\n│ process ID file │ none │ -p │ pidfile │\n├────────────────────┼───────────────────┼────────┼─────────────┤\n│ │ │ │ │\n│ log file │ system log │ -l │ logfile │\n├────────────────────┼───────────────────┼────────┼─────────────┤\n│ │ │ │ │\n│ include file │ none │ none │ includefile │\n├────────────────────┼───────────────────┼────────┼─────────────┤\n│ │ │ │ │\n│ statistics path │ /var/log/ntpsec │ -s │ statsdir │\n├────────────────────┼───────────────────┼────────┼─────────────┤\n│ │ │ │ │\n│ keys file │ none │ -k │ keys │\n└────────────────────┴───────────────────┴────────┴─────────────┘\n\n\nConfiguration files are parsed according to the following rules:\n\n1. The plain config file (normally /etc/ntp.conf but the path can be overridden by the -c\noption) is read first if it exists.\n\n2. Then the configuration directory, if it exists, is scanned. Normally this directory is\n/etc/ntpsec/ntp.d, but if the -c option is specified the /etc/ntpsec will be specified by\nthe directory name of the -c argument.\n\n3. Each file beneath the configuration directory with the extension \".conf\" is interpreted.\nFiles are interpreted in ASCII sort order of their pathnames. Files with other extensions\nor no extensions are ignored.\n", "subsections": [] }, "SIGNALS": { "content": "SIGQUIT, SIGINT, and SIGTERM will cause ntpd to clean up and exit.\n\nSIGHUP checks various things that would otherwise require restarting ntpd.\n\nIt will reopen the log file if it has changed and check for a new leapseconds file if one was\nspecified.\n\nIf the NTS server is enabled, it will reload the certificate file if it has changed. (It\ndoesn’t check for a new key file, but reloads it when it reloads the certificate file.)\n\nIt will also retry any pending DNS or NTS lookups.\n\nOn most systems, you can send SIGHUP to ntpd with\n\n# killall -HUP ntpd\n\nIf built with debugging enabled (waf configured with --enable-debug) SIGUSR1 will increase\nthe debug level by 1 and SIGUSR2 will decrease it by 1. This may be helpful if you are\nrunning with -n, either just to see the logging on your screen or with gdb.\n", "subsections": [] }, "BUGS": { "content": "The -V option is not backward-compatible with its use (as the equivalent of -Z) in older\nversions.\n", "subsections": [] }, "STANDARDS": { "content": "RFC 1059\nDavid L. Mills, Network Time Protocol (Version 1), RFC 1059\n\nRFC 1119\nDavid L. Mills, Network Time Protocol (Version 2), RFC 1119\n\nRFC 1305\nDavid L. Mills, Network Time Protocol (Version 3), RFC 1305\n\nRFC 5905\nDavid L. Mills and J. Martin, Ed. and J. Burbank and W. Kasch, Network Time Protocol\nVersion 4: Protocol and Algorithms Specification, RFC 5905\n\nRFC 5907\nH. Gerstung and C. Elliott and B. Haberman, Ed., Definitions of Managed Objects for\nNetwork Time Protocol Version 4: (NTPv4), RFC 5907\n\nRFC 5908\nR. Gayraud and B. Lourdelet, Network Time Protocol (NTP) Server Option for DHCPv6,\nRFC 5908\n", "subsections": [] }, "EXIT STATUS": { "content": "One of the following exit values will be returned:\n\n0 (EXITSUCCESS)\nSuccessful program execution.\n\n1 (EXITFAILURE)\nExecution failed - examine system logfiles.\n", "subsections": [] }, "SEE ALSO": { "content": "ntp.conf(5), ntpq(1), ntpdig(1).\n\nNTPsec 2024-04-01 NTPD(8)", "subsections": [] } } } }