[CentOS] system time automatically fowards in time and then comes back to normal

Sun Nov 22 13:09:30 UTC 2009
Alexander Dalloz <ad+lists at uni-x.org>

ankush grover schrieb:
> Hi friends,
> 
> I am running Nagios 2.7-1 on Centos 5.0 32-bit hosted on Vmware ESX
> 4.0. The issue I am seeing on the server is sometimes nagios is
> showing the below messages in /var/log/messages and as the system time
> gets changed some false alarms gets generated. I searched it on the
> google but I am not able to find the correct solution. I even posted
> on the nagios forum and they asked me to see elsewhere why the server
> shitfs so much before looking at nagios.
> 
> 
> Nov 21 20:37:12 linuxmonitoring nagios: Warning: A system time change
> of 4398 seconds (forwards in time) has been detected.  Compensating...
> Nov 21 19:23:54 linuxmonitoring nagios: Warning: A system time change
> of 4398 seconds (backwards in time) has been detected.  Compensating..
> 
> 
> Earlier this server was syncing time through ntp daemon and below is
> the ntp.conf file. Now I have set a cronjob which sync the time with
> the ntp server every 5 minutes but still the problem persist.
> 
> ntp.conf file
> 
> 
> restrict default ignore
> restrict 127.0.0.1
> driftfile /var/lib/ntp/drift
> broadcastdelay 0.008
> #authenticate yes
> keys /etc/ntp/keys
> restrict 172.16.6.3 nomodify notrap noquery
> server 172.16.6.3
> restrict 172.16.6.2 nomodify notrap noquery
> server 172.16.6.2
> 
> Please see the output of hwclock and date at the same time.
> hwclock
> Sat 21 Nov 2009 08:19:02 PM IST  -0.496922 seconds
> 
> date
> Sat Nov 21 20:19:55 IST 2009
> 
> 
> Please advice what I need to do to fix this error.
> 
> 
> Regards
> 
> Ankush

Be sure that only 1 mechanism for syncing time is active for your VM:
either NTP client configuration through ntpd running (like you have) OR
through the VMware tools. Both being active will result in trouble.

VMware recommends to use time syncronisation through NTP within the VM.

To debug your time sources in NTP make use of "ntpq" and/or "ntpdc".

Regards

Alexander