What does "spike_detect" ntp messages mean?

环境

• Red Hat Enterprise Linux (RHEL) 6
• ntp

问题

• What does "spike_detect" ntp messages mean?
• Are the NTP servers failing? Is there any problem with the NTP client?

Raw

2014-04-10T12:05:08.000+12:00 hostname ntpd[2425]: 0.0.0.0 c515 05 clock_sync
2014-04-10T12:09:29.000+12:00 hostname ntpd[2425]: 0.0.0.0 0613 03 spike_detect -0.368888 s
2014-04-10T12:31:22.000+12:00 hostname ntpd[2425]: 0.0.0.0 061c 0c clock_step -0.371011 s

决议

• Need to ensure there is no other things running on the system that is modifying system time apart from ntpd.

根源

• The messages are related with the NTP synchronization. This message is logged when ntpd notice sudden change in time and it has to step the clock.

诊断步骤

• From NTP source code:

Raw

===>>> ntp-4.2.6p5/include/ntp.h
606 /*
607  * System event codes
608  */
609 #define EVNT_UNSPEC     0       /* unspecified */
610 #define EVNT_NSET       1       /* freq not set */
611 #define EVNT_FSET       2       /* freq set */
612 #define EVNT_SPIK       3       /* spike detect */       <<<====

Raw

===>>> ntp-4.2.6p5/ntpd/ntp_loopfilter.c
  53 /*
  54  * Clock discipline state machine. This is used to control the
  55  * synchronization behavior during initialization and following a
  56  * timewarp.
  57  *
  58  *      State   < step          > step          Comments
  59  *      ========================================================
  60  *      NSET    FREQ            step, FREQ      freq not set
  61  *
  62  *      FSET    SYNC            step, SYNC      freq set
  63  *
  64  *      FREQ    if (mu < 900)   if (mu < 900)   set freq direct
  65  *                  ignore          ignore
  66  *              else            else
  67  *                  freq, SYNC      freq, step, SYNC
  68  *
  69  *      SYNC    SYNC            SPIK, ignore    adjust phase/freq
  70  *
  71  *      SPIK    SYNC            if (mu < 900)   adjust phase/freq
  72  *                                  ignore
  73  *                              step, SYNC
  74  */

• Make sure there is no execution of ntpdate -u command while ntpd is running (via cron or manually). If ntpdate change clock, ntpd will write spike_detected messages.