Message similar to "ntpd Deleting interface #16 ethX:1 , x.x.x.x#123" in /var/log/messages

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux
    • ntpd

Issue

  • ntpd is apparently deleting interfaces
  • Following messages appear in /var/log/messages:
Nov  9 01:10:09 <example> ntpd[27847]: Deleting interface #16 ethX:1, x.x.x.x#123, interface stats: received=0, sent=0, dropped=0, active_time=522 secs
Nov  9 01:10:09 <example> ntpd[27847]: Deleting interface #17 ethX:1, x.x.x.x#123, interface stats: received=0, sent=0, dropped=0, active_time=522 secs

Resolution

  • In order for NTP to avoid virtual interfaces, the -L option can be added to the /etc/sysconfig/ntpd configuration file in the following manner:
--- /etc/sysconfig/ntpd.bak 2016-09-26 08:35:05.408966980 -0400
+++ /etc/sysconfig/ntpd 2016-09-26 08:35:14.461086105 -0400
@@ -1,2 +1,2 @@
 # Command line options for ntpd
-OPTIONS="-g"
+OPTIONS="-g -L"

Root Cause

The message above is emitted when an interface that NTP originally was using is no longer present. By default, NTP will communicate over alias interfaces. When these interfaces are added, the following message is reported:

Sep 26 08:52:47 <example> ntpd[1426]: Listen normally on 7 eth0:1 10.0.0.1 UDP 123
Sep 26 08:52:47 <example> ntpd[1426]: 10.11.160.238 interface 10.13.153.112 -> 10.0.0.1
Sep 26 08:52:47 <example> ntpd[1426]: 10.16.255.1 interface 10.13.153.112 -> 10.0.0.1
Sep 26 08:52:47 <example> ntpd[1426]: 10.5.26.10 interface 10.13.153.112 -> 10.0.0.1
Sep 26 08:52:47 <example> ntpd[1426]: 10.5.27.10 interface 10.13.153.112 -> 10.0.0.1
Sep 26 08:52:48 <example> ntpd[1426]: 0.0.0.0 0618 08 no_sys_peer

When this interface is removed, the corresponding deleted message is emitted:

Sep 26 08:55:17 <example> ntpd[1426]: Deleting interface #7 eth0:1, 10.0.0.1#123, interface stats: received=0, sent=12, dropped=0, active_time=150 secs

These messages are a reaction to interfaces being added and removed within the underlying networking stack, and only refer to NTPD's use of the interface. The NTP service does not itself add or remove networking interfaces from the system.

Of note: When a system is part of a clustered system deployment, this message can be indicative of a VIP migration event. If the message precedes or follows a service failure within a cluster, it is recommended to reach out to the Cluster suite support team in order to investigate the suite operation surrounding that period of time.

Diagnostic Steps

  • Confirm the existence of the message within the system logs.
  • Determine if there is any negative impact of the message such as a service failure within a cluster.
  • Component
  • ntp

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments