Comment by amelius

5 days ago

But can't NTP server downtime cause a disaster?

One (amongst many) NTP server going down creates less issues than an NTP server spreading wrong time.

  • General rule of thumb: a misbehaving/slow server in any well-architected distributed system is vastly worse than a dead server.

  • technically if you have 3 or more sources that would be caught; NTP protocol was designed for that eventuality

    • > technically if you have 3 or more sources that would be caught; NTP protocol was designed for that eventuality

      Either go with one clock in your NTPd/Chrony configuration, or ≥4.

      Yes, if you have 3 they can triangulate, but if one goes offline now you have 2 with no tie-breaker. If you have (at least) 4 servers, then one can go away and triangulation / sanity-checking can still occur with the 3 remaining.

      1 reply →

    • Sure, but not needing a failure to cascade to yet another failsafe is still a good idea. After all, all software has bugs, and all networks have configuration errors.