Deployment Architecture

How do we handle servers with untuned NTP service?

ddrillic
Ultra Champion

We occasionally come across servers with universal forwarders or devices that send syslog and their NTP service is off, which obviously causes some incorrect times to flow into Splunk.

How are other teams deal with it, detecting the issue? fixing, etc.

A handy definition of NTP ; -)

-- The Network Time Protocol (NTP) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. In operation since before 1985, NTP is one of the oldest Internet protocols in current use. NTP was designed by David L. Mills of the University of Delaware

Labels (1)
Tags (3)
0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

You could check out this NTPDrifter app to help identify the problem servers.

https://splunkbase.splunk.com/app/1292/

As for fixing the issue, I believe the best way is to correct the NTP problem at the source. Trying to manipulate your searches to account for it would really just be a band-aid and not even sure there would be a good way to do it.

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

You could check out this NTPDrifter app to help identify the problem servers.

https://splunkbase.splunk.com/app/1292/

As for fixing the issue, I believe the best way is to correct the NTP problem at the source. Trying to manipulate your searches to account for it would really just be a band-aid and not even sure there would be a good way to do it.

damode
Motivator

Does it require a Splunk restart after NTP settings on the server is changed, if the server is a Heavy Forwarder ?

0 Karma

ddrillic
Ultra Champion

Makes perfect sense @kmorris_splunk - thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...