Monitoring Options

Last update: May 4, 2022 17:05 UTC (dbea9b7d4)

gif

from Pogo, Walt Kelly

Pig was hired to watch the logs.


Table of Contents


Introduction

The ntpd includes a comprehensive monitoring facility which collects statistical data of various types and writes the data to files associated with each type at defined events or intervals. The files associated with a particular type are collectively called the generation file set for that type. The files in the file set are the members of that set.

File sets have names specific to the type and generation epoch. The names are constructed from three concatenated elements prefix, filename and suffix:

prefix

The directory path specified in the statsdir command.

name

The name specified by the file option of the filegen command.

suffix

A string of elements bdginning with . (dot) followed by a number of elements depending on the file set type.

Statistics files can be managed using scripts, examples of which are in the ./scripts directory. Using these or similar scripts and Unix cron jobs, the files can be automatically summarized and archived for retrospective analysis.


Monitoring Commands

filegen name file filename [type type] [link | nolink] [enable | disable] name

Specifies the file set type from the list in the next section.

file filename

Specifies the file set name.

type typename

Specifies the file set interval. The following intervals are supported with default day:

none

The file set is actually a single plain file.

pid

One file set member is created for every incarnation of ntpd. The file name suffix is the string .n, where n is the process ID of the ntpd server process.

day

One file set member is created per day. A day is defined as the period between 00:00 and 23:59 UTC. The file name suffix is the string .yyyymmdd, where yyyy is the year, mm the month of the year and dd the day of the month. Thus, member created on 10 December 1992 would have suffix .19921210.

week

One file set member is created per week. The week is defined as the day of year modulo 7. The file name suffix is the string .yyyyWww, where yyyy is the year, W stands for itself and ww the week number starting from 0. For example, The member created on 10 January 1992 would have suffix .1992W1.

month

One file set member is created per month. The file name suffix is the string .yyyymm, where yyyy is the year and mm the month of the year starting from 1. For example, The member created on 10 January 1992 would have suffix .199201.

year

One file set member is generated per year. The file name suffix is the string .yyyy, where yyyy is the year. For example, The member created on 1 January 1992 would have suffix .1992.

age

One file set member is generated every 24 hours of ntpd operation. The filename suffix is the string .adddddddd, where a stands for itself and dddddddd is the ntpd running time in seconds at the start of the corresponding 24-hour period.

link | nolink

It is convenient to be able to access the current file set members by file name, but without the suffix. This feature is enabled by link and disabled by nolink. If enabled, which is the default, a hard link from the current file set member to a file without suffix is created. When there is already a file with this name and the number of links to this file is one, it is renamed by appending a dot, the letter C, and the pid of the ntpd server process. When the number of links is greater than one, the file is unlinked. This allows the current file to be accessed by a constant name.

enable | disable

Enable or disable the recording function, with default enable. These options are intended for remote configutation commands.

statsdir directory_path

Specify the directory path prefix for statistics file names.


File Set Types

clockstats

Record reference clock statistics. Each update received from a reference clock driver appends one line to the clockstats file set:

49213 525.624 127.127.4.1 93 226 00:08:29.606 D

Item Units Description
49213 MJD date
525.624 s time past midnight
127.127.4.1 IP reference clock address
message text log message

The message field includes the last timecode received in decoded ASCII format, where meaningful. In some cases a good deal of additional information is displayed. See information specific to each reference clock for further details.

cryptostats

Record significant events in the Autokey protocol. This option requires the OpenSSL cryptographic software library. Each event appends one line to the cryptostats file set:

49213 525.624 128.4.1.1 message

Item Units Description
49213 MJD date
525.624 s time past midnight
128.4.1.1 IP source address (0.0.0.0 for system)
message text log message

The message field includes the message type and certain ancillary information. See the Authentication Options page for further information.

loopstats

Record clock discipline loop statistics. Each system clock update appends one line to the loopstats file set:

50935 75440.031 0.000006019 13.778 0.000351733 0.013380 6

Item Units Description
50935 MJD date
75440.031 s time past midnight
0.000006019 s clock offset
13.778 PPM frequency offset
0.000351733 s RMS jitter
0.013380 PPM RMS frequency jitter (aka wander)
6 log2 s clock discipline loop time constant
peerstats

Record peer statistics. Each NTP packet or reference clock update received appends one line to the peerstats file set:

48773 10847.650 127.127.4.1 9714 -0.001605376 0.000000000 0.001424877 0.000958674

Item Units Description
48773 MJD date
10847.650 s time past midnight
127.127.4.1 IP source address
9714 hex status word
-0.001605376 s clock offset
0.000000000 s roundtrip delay
0.001424877 s dispersion
0.000958674 s RMS jitter

The status field is encoded in hex format as described in Appendix B of the NTP specification RFC 1305.

protostats

Record significant peer, system and rptpcp events. Each significant event appends one line to the protostats file set:

49213 525.624 128.4.1.1 963a 8a message

Item Units Description
49213 MJD date
525.624 s time past midnight
128.4.1.1 IP source address (0.0.0.0 for system)
963a code status word
8a code event message code
message text event message

The event message code and message field are described on the Event Messages and Status Words page.

rawstats

Record timestamp statistics. Each NTP packet received appends one line to the rawstats file set:

50928 2132.543 128.4.1.1 128.4.1.20 3102453281.584327000 3102453281.58622800031 02453332.540806000 3102453332.541458000

Item Units Description
50928 MJD date
2132.543 s time past midnight
128.4.1.1 IP source address
128.4.1.20 IP destination address
3102453281.584327000 NTP s origin timestamp
3102453281.58622800031 NTP s receive timestamp
02453332.540806000 NTP s transmit timestamp
3102453332.541458000 NTP s destination timestamp
sysstats

Record system statistics. Each hour one line is appended to the sysstats file set in the following format:

50928 2132.543 3600 81965 0 9546 56 512 540 10 4 147 1

Item Units Description
50928 MJD date
2132.543 s time past midnight
3600 s time since reset
81965 # packets received
0 # packets for this host
9546 # current versions
56 # old version
512 # access denied
540 # bad length or format
10 # bad authentication
4 # declined
147 # rate exceeded
1 # kiss-o'-death packets sent
timingstats

(Only available when the daemon is compiled with process time debugging support (--enable-debug-timing - costs performance). Record processing time statistics for various selected code paths.

53876 36.920 10.0.3.5 1 0.000014592 input processing delay

Item Units Description
53876 MJD date
36.920 s time past midnight
10.0.3.5 IP server address
1 # event count
0.000014592 s total time
message text code path description (see source)