Wired Intelligent Edge

 View Only
last person joined: 2 days ago 

Bring performance and reliability to your network with the HPE Aruba Networking Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of your switching devices, and find ways to improve security across your network to bring together a mobile-first solution
Expand all | Collapse all

NTP log spam on 10.10.1000

This thread has been viewed 36 times
  • 1.  NTP log spam on 10.10.1000

    Posted Sep 07, 2022 11:01 AM
    Hello,

    I have 6100s and 6300s that I just upgraded to 10.10.1000 from some 10.09 release.

    Since then, I have 2 new problems, across all 6100s and 6300s.

    First problem is NTP log spam. Following report is from a 6300 (copy-pasted from a remote syslog server):

    Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
    Sep  5 19:53:45 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
    Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
    Sep  5 19:53:56 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41
    Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1106|LOG_INFO|||NTP primary server connection lost to 10.1.1.41
    Sep  5 19:54:06 cx632 ntp-mgrd[4655] Event|1105|LOG_INFO|||NTP primary server connection established to 10.1.1.41

    So I ran tcpdump on the ntp server and the only relevant traffic is a request/reply every ~64s, while the switch logs a connection lost/established event pair every ~10s. It makes no sense, as the switch report a connection lost/established pair while no traffic is even exchanged with the ntp server!

    Relevant config:

    ntp server 10.1.1.41 minpoll 4 maxpoll 7 iburst prefer
    ntp server 10.1.1.42 minpoll 4 maxpoll 7 iburst
    ntp server pool.ntp.org minpoll 4 maxpoll 8 iburst
    ntp server redacted1 minpoll 4 maxpoll 7 iburst
    ntp server redacted2 minpoll 4 maxpoll 7 iburst
    ntp server redacted3 minpoll 4 maxpoll 7 iburst
    ntp server redacted4 minpoll 4 maxpoll 7 iburst

    The other problem, may be related or not:

    Sep  5 19:58:32 cx632 log-mgmtd[3245] Event|1231|LOG_INFO|CDTR|1|Syslog client restarted due to configuration change.
    Sep  5 19:58:33 cx632 log-proxyd[770] Event|1233|LOG_INFO|CDTR|1|Starting System Logging Service.
    Sep  5 19:58:33 cx632 log-proxyd[770] Event|1234|LOG_INFO|CDTR|1|Started System Logging Service.

    It happens every few minutes, not a definite/identifiable frequency. What "configuration" is this "configuration change" referring to? Because I'm not making any change to the running-configuration (or startup-configuration) and there is only an idle ssh connection to the switch, which is not doing anything fancy.

    Despite the log spam, it seems the time is synchronized and I see no adverse effect due to the "Syslog client restarted due to configuration change"

    Thanks in advance


  • 2.  RE: NTP log spam on 10.10.1000

    Posted Sep 16, 2022 12:14 PM
    Experiencing exact same issue on 6300 switches running 10.08.1080.


  • 3.  RE: NTP log spam on 10.10.1000

    Posted Sep 16, 2022 12:21 PM
    In release notes from 10.09.1050 released this week, under "fixed issues" there is bug ID 233678:

    Symptom: Frequent event logs are generated for NTP with the message NTP primary server connection lost.
    Scenario:When two or more NTP servers are configured and connected the event logs will generate the error.
    Workaround:None. These event logs are misleading and can be ignored. The NTP server connection is stable can be verified using show ntp associations.



  • 4.  RE: NTP log spam on 10.10.1000

    Posted Sep 16, 2022 12:27 PM
    Thanks! Time to test out 10.09.1050 in the lab!


  • 5.  RE: NTP log spam on 10.10.1000

    MVP GURU
    Posted Sep 20, 2022 06:01 AM
    ...and/or wait for an updated build of the ArubaOS-CX 10.10 software release too (say with a new ArubaOS-CX 10.10.10xx): indeed this issue is hitting the 10.10 along with the 10.08 and 10.09.

    P.S. Also, the ArubaOS-CX 10.08.1090 fixes the reported issue (Bug ID 233678 - NTP).


  • 6.  RE: NTP log spam on 10.10.1000

    Posted Sep 20, 2022 08:16 AM
    I'll wait for the 10.10 build, good to see it is confirmed elsewhere. Thanks.

    What isn't clear though is whether the second issue ("Syslog client restarted due to configuration change") is related and expected to be fixed along the NTP bug.


  • 7.  RE: NTP log spam on 10.10.1000

    MVP GURU
    Posted Sep 20, 2022 12:05 PM
    "...good to see it is confirmed elsewhere" Where? mine was just a guess since Aruba released new build on 10.08 and 10.09 and not on 10.10 yet.


  • 8.  RE: NTP log spam on 10.10.1000

    Posted Sep 20, 2022 04:39 PM
    Where? bug ID 233678.

    Without access to either bug tracker or source code, I can only make assumptions.... in particular the assumption that this bug with an identical description affecting 10.08 and 10.09 is also the one affecting 10.10. Seems fair and reasonable, right? All in all, it doesn't really affect functionality and patience will confirm whether this assumption is correct when a new 10.10 build is released.

    Why bug didn't show up when I was running 10.09.1020 is not something I'll bother researching... 10.09.1050 release notes do not state when bug was introduced and with no access to the bug tracker for ID 233678, why bother?


  • 9.  RE: NTP log spam on 10.10.1000

    Posted Sep 27, 2022 01:33 PM
    Release notes for 10.10.1010 are up and are showing that 233678 is resolved in this version as well.


  • 10.  RE: NTP log spam on 10.10.1000

    Posted Apr 16, 2023 11:09 AM

    hello sir, 

    is issue of Syslog client restarted due to configuration change solved ?

    why this issue happen ? because we dont see any changes configuration in the switch,

    show history is blank



    ------------------------------
    BR,

    Hudaya
    ------------------------------