Hi, I have a question about time synchronization in SUSELinux.
Due to a power problem in DC, z/VM stopped and the server went down.
The server is back up now, but we need to investigate the server downtime, so we checked the syslog and found that there is a time discrepancy between each server.
For example, server A stopped at 11:09, while server B stopped at 11:17, even though they are servers on the same z/VM.
The same ntp server is specified in ntp.conf.
One possible explanation is that the time synchronization was not working properly at the stage before the shutdown.
I can confirm that the time synchronization is currently working, but
Is there any way to check if the time was synchronized before the event occurred?
Also, is there any way to confirm detailed information about the server’s time synchronization?
I’m not a SUSE user (Ubuntu & RHEL variants for me), but there are a couple of things I’d check/verify.
First, are you using ntpd or something else like chronyd (which uses /etc/chrony.conf)? I thought I’d heard SUSE switched to chronyd.
Second, what are your NTP servers’ primary roles and could they get I/O bound? I saw an environment try to use their SANs as NTP and it caused the network to get out of sync due to them being periodically unresponsive when they had large copies saturating their I/O. Cleared up after they moved it from their SANs to their core router.
For checking the past the only thing I could think of is going back through the logs looking for either events you know were simultaneous or ntp messages about time skew to see if something pushed it far at one point. I’d likely just consider the server stop as evidence. I haven’t used z/VM, but anything on the hypervisor logs side that’d tell you when the VMs powered off?