ntp package missing logcheck exceptions file /etc/logcheck/ignore.d.server/ntp

Bug #1046340 reported by Tim Miller Dyck
This bug affects 2 people
Affects Status Importance Assigned to Milestone
ntp (Ubuntu)
Nominated for Precise by Christian Ehrhardt 
Nominated for Trusty by Christian Ehrhardt 

Bug Description


in Lucid, Package: ntp (1:4.2.4p8+dfsg-1ubuntu2) has the file /etc/logcheck/ignore.d.server/ntp included. This is used to configure logcheck to ignore ntp messages in syslog that are not error conditions.

In Natty, this file is not present in the ntp package
In Oneric, this file is not present in the ntp package
In Precise, this file is not present in the ntp package

When logcheck is installed, all ntp syslog messages are raised as alerts by logcheck because the ntp configuration file is not present.

It would be helpful to have /etc/logcheck/ignore.d.server/ntp included with ntp packaging as with Lucid.

Here are sample contents based on the Lucid version with the addition of "status change" tot he time sync line.

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: time reset [+-]*[0-9]{1,2}\.[0-9]{6} s$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronisation lost$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: no servers reachable$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronized to ([0-9.]{7,15}|[0-9a-fA-F:.]{4,39}), stratum [0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: synchronized to LOCAL\([0-9]+\), stratum [0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: kernel time sync (disabled|enabled|status change) [0-9]+$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: precision = [0-9]+\.[0-9]+ usec$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: peer ([.0-9]{7,15}|[0-9a-fA-F:.]{4,39}) now (in)?valid$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: adjusting local clock by -?[.0-9]+s$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: adjust time server -?[.0-9]+ offset$

Tim Miller Dyck

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: ntp 1:4.2.6.p3+dfsg-1ubuntu3.1
ProcVersionSignature: Ubuntu 3.2.0-29.46-generic 3.2.24
Uname: Linux 3.2.0-29-generic x86_64
ApportVersion: 2.0.1-0ubuntu12
Architecture: amd64
Date: Wed Sep 5 10:09:31 2012
InstallationMedia: Ubuntu-Server 11.04 "Natty Narwhal" - Release amd64 (20110426)
KernLog: Sep 5 06:34:04 cmpsVMHost01 kernel: [271957.578288] SGI XFS with ACLs, security attributes, realtime, large block/inode numbers, no debug enabled
SourcePackage: ntp
UpgradeStatus: Upgraded to precise on 2012-08-25 (10 days ago)

Revision history for this message
Tim Miller Dyck (timmillerdyck) wrote :
Dave Walker (davewalker)
Changed in ntp (Ubuntu):
importance: Undecided → Medium
Revision history for this message
Robie Basak (racb) wrote :

The change appears to have been made by Debian in 1:4.2.6+dfsg-1. The corresponding Debian bug is http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498992

Looking at the bug and at the changelog entry ("Remove ntp.logcheck.ignore.server, none of those messages are send to syslog now."), I get the impression that the intention was that this file was presumed not needed because ntpd isn't supposed to log messages to syslog any more.

Is there something on Ubuntu that makes ntpd behave differently? Is this due to our use of rsyslog? Or does this bug also affect Debian now due to some change in logging in Debian since then?

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ntp (Ubuntu):
status: New → Confirmed
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

I know it's a long time, but I'm cleaning up old NTP bugs atm.

Robie asked the right question back in 2012.
I checked todays status.

The issues still applies to Xenial as well as Debian.
So maybe whatever was the reason for the removal back then no more applies?

I reported it to Debian as it is not Ubuntu specific.
So for tracking adding https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822961

Changed in ntp:
status: Unknown → New
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Reported a new file to Debian to become integrated

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Reported a new file to Debian to become integrated

Changed in ntp (Ubuntu):
status: Confirmed → Triaged
Changed in ntp (Ubuntu):
importance: Medium → Low
Changed in ntp (Ubuntu):
assignee: nobody → ChristianEhrhardt (paelzer)
Changed in ntp (Ubuntu):
assignee: ChristianEhrhardt (paelzer) → nobody
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Unfortunately still no update on Debian including the fix.

But given that there is a workaround (place the file yourself) and this bug (unfortunately) being very old but didn't get a huge crowd being affected it is not reasonable to push a delta for that IMHO.

Also after a further check we'd have to add different logcheck files for each release as the messages weren't very stable over time.

Unassigning myself for now but still staying subscribed and on the Debian bug to wait if changes get picked up.

If anyone is willing and able to spend the time to prep the logchecks needed for all the releases I'm open to review and sponsor. Please start with what I had reported to the Debian bug, it already has some fixes in it.

Changed in ntp (Ubuntu Xenial):
status: New → Triaged
Changed in ntp (Ubuntu):
status: Triaged → Won't Fix
Changed in ntp (Ubuntu Xenial):
status: Triaged → Won't Fix
importance: Undecided → Low
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.