how to check if NTP adjusted system time on Linux?

Question

I have a machine that experienced some troubles with some of the real time stuff that I'm running. One lead that I have is that NTP daemon may have moved the time, causing false timeouts.

How do I find out if NTP daemon did indeed move time at all? Any logs? I do see NTP daemon restart in /var/log/messages, but I don't know if time adjustment should be there as well.

to clarify: I need to understand it from the logs, after the event. May be 2 days after the time was adjusted. Running commands to see the current status doesn't help.

Answer 1

you should have a value in the drift file. Its location will be in your /etc/ntp.conf

e.g: "driftfile /var/lib/ntp/drift"

this file is used to log how far your clock is from what it should be, and slowly ntp should lower this value as time progresses. - It wont do it in one go because that could cause timestamping issues on the system.

Answer 2

You can use ntpdc -c sysinfo command for querying ntpd status. It returns an output similar to this:

system peer:          0.0.0.0
system peer mode:     unspec
leap indicator:       11
stratum:              16
precision:            -20
root distance:        0.00000 s
root dispersion:      338.44917 s
reference ID:         [73.78.73.84]
reference time:       00000000.00000000  Thu, Feb  7 2036  8:28:16.000
system flags:         auth monitor ntp kernel stats
jitter:               0.000000 s
stability:            0.000 ppm
broadcastdelay:       0.003998 s
authdelay:            0.000000 s

Answer 3

ntpq -nc peers will show you your syncronization status with all peers.