Deployment Architecture

How do we handle servers with untuned NTP service?

ddrillic
Ultra Champion

We occasionally come across servers with universal forwarders or devices that send syslog and their NTP service is off, which obviously causes some incorrect times to flow into Splunk.

How are other teams deal with it, detecting the issue? fixing, etc.

A handy definition of NTP ; -)

-- The Network Time Protocol (NTP) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. In operation since before 1985, NTP is one of the oldest Internet protocols in current use. NTP was designed by David L. Mills of the University of Delaware

Labels (1)
Tags (3)
0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

You could check out this NTPDrifter app to help identify the problem servers.

https://splunkbase.splunk.com/app/1292/

As for fixing the issue, I believe the best way is to correct the NTP problem at the source. Trying to manipulate your searches to account for it would really just be a band-aid and not even sure there would be a good way to do it.

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

You could check out this NTPDrifter app to help identify the problem servers.

https://splunkbase.splunk.com/app/1292/

As for fixing the issue, I believe the best way is to correct the NTP problem at the source. Trying to manipulate your searches to account for it would really just be a band-aid and not even sure there would be a good way to do it.

damode
Motivator

Does it require a Splunk restart after NTP settings on the server is changed, if the server is a Heavy Forwarder ?

0 Karma

ddrillic
Ultra Champion

Makes perfect sense @kmorris_splunk - thank you!

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...