1

CentOS 7, set it up about 3 years ago, so I might not remember every decision I made...

Once an hour, something does a time update. I don't have ntp installed, only ntpdate. Don't have chrony installed either.

There's nothing in /etc/crontab, /etc/cron.hourly. There's no /etc/ntp.conf file.

timedatectl says NTP Enabled: n/a NTP Synchronized: No

But something is reaching out and touching 10 time servers every hour.

Suggestions on how to find it?

michele654
  • 21
  • 3
  • 1
    What about user crontabs? (e.g: `/var/spool/cron/crontabs/`). How do you know it's dealing with 10 time servers? Do you observe time slipping backward / forward? Is the system time reasonably correct? – Attie Jun 04 '20 at 14:52
  • 1
    I hadn't looked in user crontabs, but there is only root and it's not in that one. Good call though! I know because the firewall logs the outbound requests – michele654 Jun 05 '20 at 18:09

2 Answers2

1

I manage the server using Webmin mostly, but command line too.

user1686 asked questions that led me to the System Time scheduled function in Webmin.

Turned that off, and it stopped! Woohoo!

Thanks for giving me pointers that led to the answer.

-Michele

michele654
  • 21
  • 3
0

  1. The system log (either a file in /var/log, or the journalctl ... command) will usually have messages corresponding to every periodic job.

  2. Many cron daemons also read additional jobs from /etc/cron.d.

  3. Root has a per-user crontab, accessible via crontab -l and crontab -e, which is separate from the system-wide /etc/crontab.

  4. You might have created a systemd "timer" to run ntpdate. Use systemctl list-timers and check the files present in /etc/systemd/system (plus symlinks in the timers.target.wants/ subdirectory).

  5. It might be something else than ntpdate, such as systemd-timesyncd or another SNTP client.

u1686_grawity
  • 426,297
  • 64
  • 894
  • 966
  • I've tried the /var/log files, journalctl, can't find anything that looks interesting. checked /etc/cron.d checked roots per-user crontab, good catch there though! Not systemd timer, but it's really close... All the checking for that led me to webmin, which had a System Time scheduled function set to run every hour. – michele654 Jun 05 '20 at 19:04