[CentOS] Strange NTP problem

[Alfred von Campe]

On May 21, 2008, at 0:55, Paul Heinlein wrote:

> Yeah, with an offset of 54 seconds, it's a bad system. :-)
>
> Try this (assuming 10.101.32.104 is your preferred local NTP server):
>
>   service ntpd stop
>   echo "10.101.32.104" > /etc/ntp/step-tickers
>   service ntpd start
>
> Adding a server to the step-tickers file will tell the ntpd init  
> script to do an ntpdate sync against that host before starting ntpd.

In effect, that's what I did manually.  When I found out that about  
this problem, I did the following:

   # service ntpd stop
   # ntpdate ntp
   # service ntpd start

(ntp is a CNAME record for our local NTP server).  But after 24  
hours, the system was off my more than 5 minutes.  Why would it not  
bind to the NTP server.  Here is some output from tshark while ntpd  
was running:

# tshark udp port 123
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
   0.000000 10.66.42.109 -> 10.101.32.104 NTP NTP client
   0.000683 10.101.32.104 -> 10.66.42.109 NTP NTP server
1025.000547 10.66.42.109 -> 10.101.32.104 NTP NTP client
1025.002017 10.101.32.104 -> 10.66.42.109 NTP NTP server
2050.000145 10.66.42.109 -> 10.101.32.104 NTP NTP client
2050.000812 10.101.32.104 -> 10.66.42.109 NTP NTP server
3076.000485 10.66.42.109 -> 10.101.32.104 NTP NTP client
3076.001917 10.101.32.104 -> 10.66.42.109 NTP NTP server
4101.001065 10.66.42.109 -> 10.101.32.104 NTP NTP client
4101.002016 10.101.32.104 -> 10.66.42.109 NTP NTP server
5126.000671 10.66.42.109 -> 10.101.32.104 NTP NTP client
5126.001551 10.101.32.104 -> 10.66.42.109 NTP NTP server
6151.001270 10.66.42.109 -> 10.101.32.104 NTP NTP client
6151.001868 10.101.32.104 -> 10.66.42.109 NTP NTP server
7175.999866 10.66.42.109 -> 10.101.32.104 NTP NTP client
7176.000482 10.101.32.104 -> 10.66.42.109 NTP NTP server
8201.999206 10.66.42.109 -> 10.101.32.104 NTP NTP client
8202.000563 10.101.32.104 -> 10.66.42.109 NTP NTP server
9227.000796 10.66.42.109 -> 10.101.32.104 NTP NTP client
9227.001462 10.101.32.104 -> 10.66.42.109 NTP NTP server

Does this make any sense?

Alfred