Miscellaneous Commands and Options

We have three, now looking for more.

Last update: 9-Nov-2016 12:26 UTC

Commands and Options

broadcastdelay delay

In broadcast and multicast modes, means are required to determine the network delay between the server and client. Ordinarily, this is done automatically by the initial calibration exchanges between the client and server. In some cases, the exchange might not be possible due to network or server access controls. The value of delay is by default zero, in which case the exchange is enabled. If delay is greater than zero, it becomes the roundtrip delay (s), as measured by the Unix ping program, and the exchange is disabled.

driftfile driftfile

This command specifies the complete path and name of the file used to record the frequency of the local clock oscillator. This is the same operation as the -f command line option. This command is mutually exclusive with the freq option of the tinker command.

If the file exists, it is read at startup in order to set the initial frequency and then updated once per hour or more with the current frequency computed by the daemon. If the file name is specified, but the file itself does not exist, the starts with an initial frequency of zero and creates the file when writing it for the first time. If this command is not given, the daemon will always start with an initial frequency of zero.

The file format consists of a single line containing a single floating point number, which records the frequency offset measured in parts-per-million (PPM). The file is updated by first writing the current drift value into a temporary file and then renaming this file to replace the old version.

dscp dscp

This command specifies the Differentiated Services Code Point (DSCP) value that is used in sent NTP packets. The default value is 46 for Expedited Forwarding (EF).

Provides a way to enable or disable various system options. Flags not mentioned are unaffected. Note that most of these flags can be modified remotely using ntpq utility program's :config and config-from-file commands.

auth: Enables the server to synchronize with unconfigured peers only if the peer has been correctly authenticated using either public key or private key cryptography. The default for this flag is enable.
bclient: Enables the server to listen for a message from a broadcast or multicast server, as in the multicastclient command with default address. The default for this flag is disable.
calibrate: Enables the calibrate feature for reference clocks. The default for this flag is disable.
kernel: Enables the kernel time discipline, if available. The default for this flag is enable if support is available, otherwise disable.
mode7: Enables processing of NTP mode 7 implementation-specific requests which are used by the deprecated ntpdc program. The default for this flag is disable. This flag is excluded from runtime configuration using ntpq. The ntpq program provides the same capabilities as ntpdc using standard mode 6 requests.
monitor: Enables the monitoring facility. See the ntpq program and the monstats and mrulist commands, as well as the Access Control Options for details. The monitoring facility is also enabled by the presence of limited in any restrict commands. The default for this flag is enable.
ntp: Enables time and frequency discipline. In effect, this switch opens and closes the feedback loop, which is useful for testing. The default for this flag is enable.
stats: Enables the statistics facility. See the Monitoring Options page for further information. The default for this flag is enabled. This flag is excluded from runtime configuration using ntpq.
unpeer_crypto_early: Enables the early resetting of an association in case of a crypto failure. This is generally a feature, but it can be used in a DoS attack. If you are seeing these packets being used as a DoS attack against your server, you should disable this flag. The default for this flag is enabled. This flag is excluded from runtime configuration using ntpq.
unpeer_crypto_nak_early: Enables the early resetting of an association in case of a crypto_NAK message. This is generally a feature, but it can be used in a DoS attack. If you are seeing these packets being used as a DoS attack against your server, you should disable this flag. The default for this flag is enabled. This flag is excluded from runtime configuration using ntpq.
unpeer_digest_early: Enables the early resetting of an association in case of an autokey digest failur. This is generally a feature, but it can be used in a DoS attack. If you are seeing these packets being used as a DoS attack against your server, you should disable this flag. The default for this flag is enabled. This flag is excluded from runtime configuration using ntpq.

includefile includefile

This command allows additional configuration commands to be included from a separate file. Include files may be nested to a depth of five; upon reaching the end of any include file, command processing resumes in the previous configuration file. This option is useful for sites that run ntpd on multiple hosts, with (mostly) common options (e.g., a restriction list).

This command controls which network addresses ntpd opens, and whether input is dropped without processing. The first parameter determines the action for addresses which match the second parameter. That parameter specifies a class of addresses, or a specific interface name, or an address. In the address case, prefixlen determines how many bits must match for this rule to apply. ignore prevents opening matching addresses, drop causes ntpd to open the address and drop all received packets without examination. Multiple interface commands can be used. The last rule which matches a particular address determines the action for it. interface commands are disabled if any -I, --interface, -L, or --novirtualips command-line options are used. If none of those options are used and no interface actions are specified in the configuration file, all available network addresses are opened. The nic command is an alias for interface.

leapfile leapfile

This command loads the IERS leapseconds file and initializes the leapsecond values for the next leapsecond time, expiration time and TAI offset. The file can be obtained directly from the IERS at https://hpiers.obspm.fr/iers/bul/bulc/ntp/leap-seconds.list or ftp://hpiers.obspm.fr/iers/bul/bulc/ntp/leap-seconds.list.

The leapfile is scanned when ntpd processes the leapfile directive or when ntpd detects that leapfile has changed. ntpd checks once a day to see if the leapfile has changed.

While not strictly a security function, the Autokey protocol provides means to securely retrieve the current or updated leapsecond values from a server.

leapsmearinterval seconds

This EXPERIMENTAL option is only available if ntpd was built with the --enable-leap-smear option to the configure script. It specifies the interval over which a leap second correction will be applied. Recommended values for this option are between 7200 (2 hours) and 86400 (24 hours). DO NOT USE THIS OPTION ON PUBLIC-ACCESS SERVERS! See http://bugs.ntp.org/2855 for more information.

logconfig configkeyword

This command controls the amount and type of output written to the system syslog facility or the alternate logfile log file. All configkeyword keywords can be prefixed with =, + and -, where = sets the syslogmask, + adds and - removes messages. syslog messages can be controlled in four classes (clock, peer, sys and sync). Within these classes four types of messages can be controlled: informational messages (info), event messages (events), statistics messages (statistics) and status messages (status).

Configuration keywords are formed by concatenating the message class with the event class. The all prefix can be used instead of a message class. A message class may also be followed by the all keyword to enable/disable all messages of the respective message class. By default, logconfig output is set to allsync.

Thus, a minimal log configuration could look like this:

logconfig=syncstatus +sysevents

This would just list the synchronizations state of ntpd and the major system events. For a simple reference server, the following minimum message configuration could be useful:

logconfig=syncall +clockall

This configuration will list all clock information and synchronization information. All other events and messages about peers, system events and so on is suppressed.

logfile logfile

This command specifies the location of an alternate log file to be used instead of the default system syslog facility. This is the same operation as the -l command line option.

Controls size limits of the monitoring facility Most Recently Used (MRU) list of client addresses, which is also used by the rate control facility.

maxdepth count maxmem kilobytes: Equivalent upper limits on the size of the MRU list, in terms of entries or kilobytes. The actual limit will be up to incalloc entries or incmem kilobytes larger. As with all of the mru options offered in units of entries or kilobytes, if both maxdepth and maxmem are used, the last one used controls. The default is 1024 kilobytes.
mindepth count: Lower limit on the MRU list size. When the MRU list has fewer than mindepth entries, existing entries are never removed to make room for newer ones, regardless of their age. The default is 600 entries.
maxage seconds: Once the MRU list has mindepth entries and an additional client address is to be added to the list, if the oldest entry was updated more than maxage seconds ago, that entry is removed and its storage reused. If the oldest entry was updated more recently, the MRU list is grown, subject to maxdepth/maxmem. The default is 64 seconds.
initalloc count initmem kilobytes: Initial memory allocation at the time the monitoring facility is first enabled, in terms of entries or kilobytes. The default is 4 kilobytes.
incalloc count incmem kilobytes: Size of additional memory allocations when growing the MRU list, in entries or kilobytes. The default is 4 kilobytes.

nonvolatile threshold

Specify the threshold in seconds to write the frequency file, with default of 1e-7 (0.1 PPM). The frequency file is inspected each hour. If the difference between the current frequency and the last value written exceeds the threshold, the file is written and the threshold becomes the new threshold value. If the threshold is not exceeded, it is reduced by half. This is intended to reduce the frequency of unnecessary file writes for embedded systems with nonvolatile memory.

phone dial ...

This command is used in conjunction with the ACTS modem driver (type 18). The arguments consist of a maximum of 10 telephone numbers used to dial USNO, NIST or European time services. The Hayes command ATDT is normally prepended to the number, which can contain other modem control codes as well.

reset [allpeers] [auth] [ctl] [io] [mem] [sys] [timer]

Reset one or more groups of counters maintained by ntpd and exposed by ntpq and ntpdc.

rlimit [memlock Nmegabytes | stacksize N4kPages | filenum Nfiledescriptors]

This command alters certain process storage allocation limits, and is only available on some operating systems. Options are as follows:

memlock Nmegabytes: Specify the number of megabytes of memory that should be allocated and locked. Probably only available under Linux, this option may be useful when dropping root (the -i option). The default is 32 megabytes on non-Linux machines, and -1 under Linux. -1 means "do not lock the process into memory". 0 means "lock whatever memory the process wants into memory".
stacksize N4kPages: Specifies the maximum size of the process stack on systems with the mlockall() function. Defaults to 50 4k pages (200 4k pages in OpenBSD).
filenum Nfiledescriptors: Specifies the maximum number of file descriptors ntp may have open at the same time. Defaults to system default.

saveconfigdir directory_path

Specify the directory in which to write configuration snapshots requested with ntpq's saveconfig command. If saveconfigdir does not appear in the configuration file, saveconfig requests are rejected by ntpd.

setvar variable [default]

This command adds an additional system variable. These variables can be used to distribute additional information such as the access policy. If the variable of the form name = value is followed by the default keyword, the variable will be listed as part of the default system variables (ntpq rv command). These additional variables serve informational purposes only. They are not related to the protocol other that they can be listed. The known protocol variables will always override any variables defined via the setvar mechanism. There are three special variables that contain the names of all variable of the same group. The sys_var_list holds the names of all system variables. The peer_var_list holds the names of all peer variables and the clock_var_list holds the names of the reference clock variables.

This command alters certain system variables used by the clock discipline algorithm. The default values of these variables have been carefully optimized for a wide range of network speeds and reliability expectations. Very rarely is it necessary to change the default values; but, some folks can't resist twisting the knobs. Options are as follows:

allan allan: Specifies the Allan intercept, which is a parameter of the PLL/FLL clock discipline algorithm, in log2 seconds with default 11 (2048 s).
dispersion dispersion: Specifies the dispersion increase rate in parts-per-million (PPM) with default 15 PPM.
freq freq: Specifies the frequency offset in parts-per-million (PPM). This option is mutually exclusive with the driftfile command.
huffpuff huffpuff: Specifies the huff-n'-puff filter span, which determines the most recent interval the algorithm will search for a minimum delay. The lower limit is 900 s (15 min), but a more reasonable value is 7200 (2 hours).See the Huff-n'-Puff Filter page for further information.
panic panic: Specifies the panic threshold in seconds with default 1000 s. If set to zero, the panic sanity check is disabled and a clock offset of any value will be accepted.
step step: Specifies the step threshold in seconds. The default without this command is 0.128 s. If set to zero, step adjustments will never occur. Note: The kernel time discipline is disabled if the step threshold is set to zero or greater than 0.5 s. Further details are on the Clock State Machine page.
stepout stepout: Specifies the stepout threshold in seconds. The default without this command is 300 s. Since this option also affects the training and startup intervals, it should not be set less than the default. Further details are on the Clock State Machine page.

tos [bcpollbstep poll-gate | beacon beacon | ceiling ceiling | cohort {0 | 1} | floor floor | maxclock maxclock | maxdist maxdist | minclock minclock | mindist mindist | minsane minsane | orphan stratum | orphanwait delay]

This command alters certain system variables used by the the clock selection and clustering algorithms. The default values of these variables have been carefully optimized for a wide range of network speeds and reliability expectations. Very rarely is it necessary to change the default values; but, some folks can't resist twisting the knobs. It can be used to select the quality and quantity of peers used to synchronize the system clock and is most useful in dynamic server discovery schemes. The options are as follows:

bcpollbstep poll-gate: This option will cause the client to delay believing backward time steps from a broadcast server for bcpollbstep poll intervals. NTP Broadcast networks are expected to be trusted, and if the server's time gets stepped backwards then it's desireable that the clients follow this change as soon as possible. However, in spite of various protections built-in to the broadcast protocol, it is possible that an attacker could perform a carefully-constructed replay attack and cause clients to erroneously step their clocks backward. If the risk of a successful broadcast replay attack is greater than the risk of the clients being out of sync in the event that there is a backward step on the broadcast time servers, this option may be used to cause the clients to delay beliveving backward time steps until poll-gate consecutive polls have been received. The default is 0, which means the client will accept these steps upon receipt. Any value from 0 to 4 can be specified.
beacon beacon: The manycast server sends packets at intervals of 64 s if less than maxclock servers are available. Otherwise, it sends packets at the beacon interval in seconds. The default is 3600 s. See the Automatic Server Discovery page for further details.
ceiling ceiling: Specify the maximum stratum (exclusive) for acceptable server packets. The default is 16. See the Automatic Server Discovery page for further details.
cohort { 0 | 1 }: Specify whether (1) or whether not (0) a server packet will be accepted for the same stratum as the client. The default is 0. See the Automatic Server Discovery page for further details.
floor floor: Specify the minimum stratum (inclusive) for acceptable server packets. The default is 1. See the Automatic Server Discovery page for further details.
maxclock maxclock: Specify the maximum number of servers retained by the server discovery schemes. The default is 10. See the Automatic Server Discovery page for further details.
maxdist maxdistance: Specify the synchronization distance threshold used by the clock selection algorithm. The default is 1.5 s. This determines both the minimum number of packets to set the system clock and the maximum roundtrip delay. It can be decreased to improve reliability or increased to synchronize clocks on the Moon or planets.
minclock minclock: Specify the number of servers used by the clustering algorithm as the minimum to include on the candidate list. The default is 3. This is also the number of servers to be averaged by the combining algorithm.
mindist mindistance: Specify the minimum distance used by the selection and anticlockhop algorithm. Larger values increase the tolerance for outliers; smaller values increase the selectivity. The default is .001 s. In some cases, such as reference clocks with high jitter and a PPS signal, it is useful to increase the value to insure the intersection interval is always nonempty.
minsane minsane: Specify the number of servers used by the selection algorithm as the minimum to set the system clock. The default is 1 for legacy purposes; however, for critical applications the value should be somewhat higher but less than minclock.
orphan stratum: Specify the orphan stratum with default 16. If less than 16 this is the stratum assumed by the root servers. See the Orphan Mode page for further details.
orphanwait delay: Specify the delay in seconds from the time all sources are lost until orphan parent mode is enabled with default 300 s (five minutes). During this period, the local clock driver and the modem driver are not selectable, unless marked with the prefer keyword. This allows time for one or more primary sources to become reachable and selectable before using backup sources, and avoids transient use of the backup sources at startup.

trap host_address [port port_number] [interface interfSace_address]

This command configures a trap receiver at the given host address and port number for sending messages with the specified local interface address. If the port number is unspecified, a value of 18447 is used. If the interface address is not specified, the message is sent with a source address of the local interface the message is sent through. Note that on a multihomed host the interface used may vary from time to time with routing changes.

The trap receiver will generally log event messages and other information from the server in a log file. While such monitor programs may also request their own trap dynamically, configuring a trap receiver will ensure that no messages are lost when the server is started.

ttl hop ...

This command specifies a list of TTL values in increasing order. up to 8 values can be specified. In manycast mode these values are used in turn in an expanding-ring search. The default is eight multiples of 32 starting at 31.

Miscellaneous Commands and Options

Related Links

Commands and Options