ntp package missing logcheck exceptions file /etc/logcheck/ignore.d.server/ntp

[Tim Miller Dyck]

Hello,

in Lucid, Package: ntp (1:4.2.4p8+dfsg-1ubuntu2) has the file /etc/logcheck/ignore.d.server/ntp included. This is used to configure logcheck to ignore ntp messages in syslog that are not error conditions.

However:
In Natty, this file is not present in the ntp package
In Oneric, this file is not present in the ntp package
In Precise, this file is not present in the ntp package

When logcheck is installed, all ntp syslog messages are raised as alerts by logcheck because the ntp configuration file is not present.

It would be helpful to have /etc/logcheck/ignore.d.server/ntp included with ntp packaging as with Lucid.

Here are sample contents based on the Lucid version with the addition of "status change" tot he time sync line.

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: time reset [+-]*[0-9]{1,2}\.[0-9]{6} s$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronisation lost$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: no servers reachable$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronized to ([0-9.]{7,15}|[0-9a-fA-F:.]{4,39}), stratum [0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronized to LOCAL\([0-9]+\), stratum [0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: kernel time sync (disabled|enabled|status change) [0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: precision = [0-9]+\.[0-9]+ usec$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: peer ([.0-9]{7,15}|[0-9a-fA-F:.]{4,39}) now (in)?valid$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: adjusting local clock by -?[.0-9]+s$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: adjust time server -?[.0-9]+ offset$

Regards,
Tim Miller Dyck

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: ntp 1:4.2.6.p3+dfsg-1ubuntu3.1
ProcVersionSignature: Ubuntu 3.2.0-29.46-generic 3.2.24
Uname: Linux 3.2.0-29-generic x86_64
ApportVersion: 2.0.1-0ubuntu12
Architecture: amd64
Date: Wed Sep 5 10:09:31 2012
InstallationMedia: Ubuntu-Server 11.04 "Natty Narwhal" - Release amd64 (20110426)
KernLog: Sep 5 06:34:04 cmpsVMHost01 kernel: [271957.578288] SGI XFS with ACLs, security attributes, realtime, large block/inode numbers, no debug enabled
ProcEnviron:
 LANGUAGE=en_CA:en
 TERM=linux
 LANG=en_CA.UTF-8
 SHELL=/bin/bash
SourcePackage: ntp
UpgradeStatus: Upgraded to precise on 2012-08-25 (10 days ago)

[Robie Basak (racb)]

The change appears to have been made by Debian in 1:4.2.6+dfsg-1. The corresponding Debian bug is http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498992

Looking at the bug and at the changelog entry ("Remove ntp.logcheck.ignore.server, none of those messages are send to syslog now."), I get the impression that the intention was that this file was presumed not needed because ntpd isn't supposed to log messages to syslog any more.

Is there something on Ubuntu that makes ntpd behave differently? Is this due to our use of rsyslog? Or does this bug also affect Debian now due to some change in logging in Debian since then?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Christian Ehrhardt  (paelzer)]

I know it's a long time, but I'm cleaning up old NTP bugs atm.

Robie asked the right question back in 2012.
I checked todays status.

The issues still applies to Xenial as well as Debian.
So maybe whatever was the reason for the removal back then no more applies?

I reported it to Debian as it is not Ubuntu specific.
So for tracking adding https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822961

[Christian Ehrhardt  (paelzer)]

Reported a new file to Debian to become integrated

[Christian Ehrhardt  (paelzer)]

Reported a new file to Debian to become integrated

[Christian Ehrhardt  (paelzer)]

Unfortunately still no update on Debian including the fix.

But given that there is a workaround (place the file yourself) and this bug (unfortunately) being very old but didn't get a huge crowd being affected it is not reasonable to push a delta for that IMHO.

Also after a further check we'd have to add different logcheck files for each release as the messages weren't very stable over time.

Unassigning myself for now but still staying subscribed and on the Debian bug to wait if changes get picked up.

If anyone is willing and able to spend the time to prep the logchecks needed for all the releases I'm open to review and sponsor. Please start with what I had reported to the Debian bug, it already has some fixes in it.