<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Have you pointed a different router/switch to your NTP server? Are they getting 16 as well? I recall a high offset/variation from clock can also make it 16.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal>A IOS device initially polls every 64ms, as the NTP server and client are better synced and there aren't dropped packets, this number increases to a maximum of 1024<o:p></o:p></p><p class=MsoNormal><a href="http://www.nil.si/ipcorner/BeOnTime/">http://www.nil.si/ipcorner/BeOnTime/</a><o:p></o:p></p><p class=MsoNormal><a href="http://www.cisco.com/en/US/products/sw/iosswrel/ps1818/products_tech_note09186a008015bb3a.shtml">http://www.cisco.com/en/US/products/sw/iosswrel/ps1818/products_tech_note09186a008015bb3a.shtml</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>“while the highest level (stratum 16) usually indicates that the clock is not working or unaccessible”<o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> cisco-voip-bounces@puck.nether.net [mailto:cisco-voip-bounces@puck.nether.net] <b>On Behalf Of </b>Jason Burns<br><b>Sent:</b> Monday, December 13, 2010 6:57 PM<br><b>To:</b> Wes Sisk<br><b>Cc:</b> Cisco VOIP<br><b>Subject:</b> Re: [cisco-voip] Trace files for CUCM/NTP problem<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ed,<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>CUCM is preferring the local clock, because your NTP reference has a Stratum of 16!<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><span class=apple-style-span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#222222'>10.192.20.10 .STEP. 16 u 488 512 376 0.244 16.553 0.052</span></span><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><span class=apple-style-span><span style='font-family:"Arial","sans-serif";color:#222222'>Fix your NTP server </span></span><span class=apple-style-span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#222222'>10.192.20.10 and you'll fix your CUCM.</span></span><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><span class=apple-style-span><span style='font-family:"Arial","sans-serif";color:#222222'>-Burns</span></span><o:p></o:p></p><div><p class=MsoNormal>On Mon, Dec 13, 2010 at 11:50 AM, Wes Sisk <<a href="mailto:wsisk@cisco.com">wsisk@cisco.com</a>> wrote:<o:p></o:p></p><div><p class=MsoNormal>what version of CM? Many changes of NTP especially this one:<br>CSCsk70971 publisher NTP down if configured NTP down or unreliable <br><br>my interpretation:<br>something on the network NTP source changed<br>now subscribers giving error that pub is unreliable<br><br>this is expected if pub cannot sync to NTP source. what changes did they make? it is still a viable NTP source for hte publisher? if not, publisher will use local clock which makes it an invalid source for all subs.<br><br><a href="http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/8x/netstruc.html#wpmkr1185636" target="_blank">http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/8x/netstruc.html#wpmkr1185636</a><span style='color:#888888'><o:p></o:p></span></p><div><p class=MsoNormal><span style='color:#888888'> <o:p></o:p></span></p></div><p class=MsoNormal><span style='color:#888888'><br>/Wes</span><o:p></o:p></p><div><div><p class=MsoNormal><br><br>Ed Leatherman wrote: <o:p></o:p></p><pre>Hi folks,<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Our operations team updated the NTP service recently (infoblox), and<o:p></o:p></pre><pre>right after that happened, I started getting syslog errors per below<o:p></o:p></pre><pre>on two different CUCM 7 clusters, both of which use that NTP server.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>ntpRunningStatus.sh: Primary node NTP server, OWP-PUB, is currently<o:p></o:p></pre><pre>inaccessible or down. Verify the network between the primary and<o:p></o:p></pre><pre>secondary nodes. Check the status of NTP on both the primary and<o:p></o:p></pre><pre>secondary nodes via CLI 'utils ntp status'. If the network is fine,<o:p></o:p></pre><pre>try restarting NTP using CLI 'utils ntp restart'.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Looking at the status on these servers, the pub looks OK but the subs show:<o:p></o:p></pre><pre>utils ntp status on all secondary nodes comes up with (example):<o:p></o:p></pre><pre> remote refid st t when poll reach delay offset jitter<o:p></o:p></pre><pre>==============================================================================<o:p></o:p></pre><pre>*127.127.1.0 LOCAL(0) 10 l 32 64 377 0.000 0.000 0.004<o:p></o:p></pre><pre> 10.192.20.10 .STEP. 16 u 488 512 376 0.244 16.553 0.052<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Restarting NTP on all nodes fixes the problem temporarily (NTP status<o:p></o:p></pre><pre>goes back to normal) but only for a short time.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>The NTP logs don't show anything other than what appears to be the NTP<o:p></o:p></pre><pre>service restarting every 30 minutes.. is this normal?<o:p></o:p></pre><pre>11/16/2010 23:00:02<o:p></o:p></pre><pre>sd_ntp|*********************************************************|<LVL::Info><o:p></o:p></pre><pre>11/16/2010 23:00:02 sd_ntp| Running sd_ntp. Process Id=12302<o:p></o:p></pre><pre> |<LVL::Info><o:p></o:p></pre><pre>11/16/2010 23:00:02<o:p></o:p></pre><pre>sd_ntp|*********************************************************|<LVL::Info><o:p></o:p></pre><pre>11/16/2010 23:00:02 sd_ntp||<LVL::Info><o:p></o:p></pre><pre>11/16/2010 23:00:02 sd_ntp|[528] Command Line parameters: -list -s|<LVL::Info><o:p></o:p></pre><pre>11/16/2010 23:00:02 sd_ntp|[585] The file /etc/ntp.conf exists|<LVL::Debug><o:p></o:p></pre><pre>11/16/2010 23:00:02 sd_ntp|[421] /etc/ntp/drift file is not changed|<LVL::Debug><o:p></o:p></pre><pre>11/16/2010 23:00:02 sd_ntp|[603] Listing all the servers|<LVL::Debug><o:p></o:p></pre><pre>11/16/2010 23:00:02 sd_ntp|sd_ntp exitinng normally.|<LVL::Info><o:p></o:p></pre><pre><o:p> </o:p></pre><pre>In both clusters, the pub and most or all of the subs are on the same<o:p></o:p></pre><pre>VLAN and physical switch.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>What other traces can I look at on CM to troubleshoot this? Anyone<o:p></o:p></pre><pre>know if there is a debug for the process that's generating my syslog<o:p></o:p></pre><pre>errors?<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>I want to make sure it's not an error on my end and hopefully have<o:p></o:p></pre><pre>some better information on whats broke before I go back to the<o:p></o:p></pre><pre>operations group. All the IOS routers using infoblox for NTP appear to<o:p></o:p></pre><pre>be working just fine, so they see no problems :)<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Thanks in advance!<o:p></o:p></pre><pre><o:p> </o:p></pre><pre> <o:p></o:p></pre></div></div></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>
<HTML><BODY><P><hr size=1></P>
<P><STRONG>
Disclaimer:
This e-mail communication and any attachments may contain confidential and privileged information and is for use by the designated addressee(s) named above only. If you are not the intended addressee, you are hereby notified that you have received this communication in error and that any use or reproduction of this email or its contents is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer. Thank you.
</STRONG></P></BODY></HTML>