NTP config for FREL from the commvault client

According to me, you can only do that from the box itself, not from the “client.”

• login to the box
• sudo to root (sudo su - )
• install ntp: (only if ntp is not installed. If /etc/ntp.conf exists, this isn’t needed)
  • yum -y install ntp
• edit the ntp:
  • nano /etc/ntp.conf
• Replace “server” in that file by your ntp server(s)
•  
  •  
  • ctrl-x to save
• Enable ntp at boot
  •  systemctl enable ntpd
• Start ntp
  •  systemctl start ntpd
     

Thanks Bart,

This question was prompted by feedback from our security team that the firewall was dropping traffic to port 123 on Internet IP addresses from this server. 
However, I was thinking the same as you and found the ntp client is not installed so what process is sending the NTP request? 

After some searching, I found that the default ntp client in CentOS 8 is a service called chrony and that seems to be where the config is.

https://linuxconfig.org/redhat-8-configure-ntp-server
The config is at /etc/chrony.conf and I can input the time servers we use if it cannot be done through the CV client.

I really want to treat this FREL machine as an appliance and not a server.  I thought there might be some configuration from the Commvault client (like an advanced setting entry) rather than having to logon to the appliance.

So while I can fix this by modifying the chrony config file, is anyone aware of a CV client config that will do the same job?

I’m hoping that the CV client can configure this server, but until I get details here’s the fix applied.

Note that the ntpd is not supported in RHEL8, so we’re better adjusting the config for chrony instead of installing ntpd.

For configuring chrony, these references seem authoritative:

https://chrony.tuxfamily.org/doc/3.4/chrony.conf.html
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_basic_system_settings/using-chrony_configuring-basic-system-settings

• make a backup of the conf file

  • cp /etc/chrony.conf /etc/chrony.conf.bak

• Edit the conf file
  • nano /etc/chrony.conf
• Comment out the default pool line
  • # pool 2.centos.pool.ntp.org iburst
• Add your NTP servers
  • server x.x.x.x iburst
  • server y.y.y.y iburst
  • ctrl+x to save and exit
• Restart the services to apply the new settings
  • systemctl restart chronyd
• Verify the NTP servers are recognised (I misspelt a hostname)
  • chronyc sources
• Apply the current time
  • chronyc makestep
• To check status
  • chronyc tracking

I also wanted to apply the correct timezone.  The reference is here:

https://linuxize.com/post/how-to-set-or-change-timezone-on-centos-8/

• Check current status
  • timedatectl
• Find your time zone (continent/city)
  • timedatectl list-timezones | grep -i Europe
• Apply the time zone (auto-complete works well here)
  • timedatectl set-timezone Europe/Dublin
• Verify current time zone, NTP status and time
  • timedatectl

It looks like there’s no client based way to configure this.  What’s the best way to create a feature request for the product?

HI @SLodge_IW,

i completely agree with you that is should be treated as a appliance, and not as a server. It should be deploy and forget, and patching/configuration should be done through CV product. 

You can create a Feature request by creating a support ticket and ask for a CMR. They can create one for you.

VMWARE Tools also used NTP for time synchronization.  I would recommend opening a case with CV Support so we can verify where the NTP packets are being generated.  We can also look into opening a CMR for an advanced settings tab for the FREL.

@Ryan9630 the chronyd.conf file was configured and active so I’m happy that it was the source of the NTP packets.

I’m not a fan of a VM getting its time from the virtualisation host.  We put a lot of effort into the NTP service we’re using and we want all of the clients to be aligned.

I’ll create a support ticket and ask for a CMR as you and @M Scheepers suggested.

Thank you folks!

Please share the case number here once you do so I can follow it.

@Mike Struening , it will take a little time to create that casebecause I have to work through our vendor but I will update this thread when I have it.

All good, I’m not going anywhere but here 

@Mike Struening Here is the case reference: 210520-269

Thanks!  I’ll keep a close eye on it, though feel free to update this thread with progress if you beat me to it 

Thanks Mike,  I’ll keep an eye on this as well but unfortunately I won’t be able to offer to test the fix because of the nature of our environment.  Our build phase is finishing shortly and the steady state phase will have low tolerance for change.

Understood.  I’ll be sure to get the thread updated once we have a fix.

Thanks @SLodge_IW !

Hey @Mike Struening , thanks for that - I’ll keep an eye on this thread for future updates. 

This is an updated version applicable to the new 11.24 FREL.

Verify current settings:

timedatectl

Configure NTP servers:

vi /etc/chronyd.conf

Add a ‘#’ in front of the pools or servers you don’t want to use.  Add 1 line for each NTP server you want to use. You can add any server specific NTP settings here e.g.

server 10.1.2.3 iburst

Save and exit that file.

(from https://documentation.commvault.com/v11/essential/102502_setting_time_zone.html)

Set time zone from the options in /usr/share/zoneinfo/area/location e.g.

ln -sf /usr/share/zoneinfo/Europe/Dublin /etc/localtime

Start and enable the chronyd service

systemctl enable chronyd ; systemctl start chronyd

Force the chronyc client to sync using NTP

chronyc makestep

Check your sources

chronyc tracking

chronyc -n sources -v

Check the system status

timedatectl

Any idea what the status is of CMR 318001? We also openend a CMR if I recall correctly to have the ability to specify the NTP servers and timezone information during the deployment of the FREL so it is slipstreamed into the appliance during the installation phase. It doesn't make sense that you have to do this after installation manually. In our case we run 30+ FREL appliances, so without proper automation this is just a shitty job if you like the time formatting within your logs to be aligned with the rest. 

Any idea what the status is of CMR 318001? We also openend a CMR, if I recall correctly, to have the ability to specify the NTP servers and timezone information being added during the deployment of the FREL, so it is slipstreamed into the appliance during the installation phase. It doesn't make sense that you have to do this after installation manually. In our case we run 30+ FREL appliances, so without proper automation this is lengthy job if you like the time formatting within your logs to be aligned with the rest of your environment. 

I would also like to see if there was an update to CMR 318001. 

However, I’ll admit that the situation has improved for our environment.  Recent Commvault agent updates have worked on the FRELs so I did not have to re-deploy them.  I deployed the 11.28.43 versions that show up as “Oracle Linux 8” and they have upgraded to 11.28.93 with no other action from me but to run the upgrade software job.

Additionally, our vulnerability scanners show no high severity vulnerabilities so I’m happy with the current state.

@SLodge_IW good to hear that! We are running FR32 and we ran into some issues with this version, but with the latest maintenance release they all should be fixed. The CMR that we raised for the ability to change the timezone is addressed in a future version and for correct time sync they seem to be making a change to the OVA configuration in a sense that it will sync periodically with the hypervisor. Right now it only syncs when the access node is started or in case you allow the access node to reach NTP to the Internet. In case you do not allow it to sync with public Internet then it will start to show time drift within a couple of weeks. 

I would recommend to enable this setting once you FREL is deployed.
 

It is turned off by default right now, but will hopefully be enabled in the near future. 

Thanks Onno.  My preference is to rely on NTP and since I have it configured already I’ll stick with it.  VMware’s recommendation is there should only be 1 method of synchronising time (https://kb.vmware.com/s/article/1189).

However if I have to re-deploy the FRELs, it makes sense to apply the VM setting you suggest.  Our ESXi hosts are configured with NTP so this setting would work for us.