When will Chrony be supported?

[mikaellindstrom]

Hi,
what's the ETA for supporting Chrony in addition to NTP? As per the release notes, RHEL 7 and CENTOS 7 are supported, but the default network time protocol function is Chrony.

Btw. Went to the Splunkbase page for this add-on (which in general is very useful!) and the "File a case" link doesn't work.

Regards,
Mikael Lindstrom

[nunoaragao]

Regarding TA nix >8.1 with support for Chrony, I'm deflated that any recent version does not attempt at having similar log events from systems with Chrony or systems with ntpdate. As most other scripts do with smart awk expressions.

Also, on systems with ntpdate BUT that run Chrony for time sync (hint: RHEL7), the script bypasses Chrony configuration. But this I managed to fix it myself by including lines 2 and 3:

if [ $FOUND_NTPDATE -eq 0 ] ; then
	echo "Found ntpdate command" >> $TEE_DEST
	if [ -f  /etc/chrony.conf ] ; then        # Special
		CONFIG=/etc/chrony.conf
	elif [ -f    /etc/ntp.conf ] ; then         # Linux; FreeBSD; AIX; Mac OS X maybe
		CONFIG=/etc/ntp.conf
	elif [ -f  /etc/inet/ntp.conf ] ; then    # Solaris
		CONFIG=/etc/inet/ntp.conf
	elif [ -f  /private/etc/ntp.conf ] ; then # Mac OS X
		CONFIG=/private/etc/ntp.conf
	else
		CONFIG=
	fi

[nunoaragao]

.. and to make chrony output similar to ntpdate, replaced the final section like this (switching the last lines of code to ntpdate condition)

( ... )
else
	CMD2="chronyc"
	assertHaveCommand $CMD2
	chronyc -n sources | awk -F"[] []+" '/\^/ {printf "server %s, stratum %d, offset %s, delay %s\n",$2,$3,$8,$10}'

Attempted to also use variable $AWK like most of the other scripts but kept having double quotes escaping errors .. gave up. Maybe not efficient but does the trick

[mikaellindstrom]

In the Splunk Linux /Unix app, the time.sh for example only supports ntp and not chrony so using the add-on on an RHEL 7 system with the default network time protocol (i.e. chrony) will be missing the NTP data. time.sh should support both NTP (legacy) and chrony (preferred).

[uthornander_spl]

It is around the corner - should be in *NIx TA 8.1. https://splunkbase.splunk.com/app/833/ that is imminent.

[uthornander_spl]

What is it that you want to do with Chrony that you can't do today?
I hadn't heard about it before but to the best of my understanding, there shouldn't be any difference to Splunk.
If it's just the matter of the time logs, you should be able to ingest them just as you ingest any other data.