ntpstat response fine but server time out of sync

Question

I found out that the ntpd service that I've set up a few weeks ago on a Centos5 machine doesn't correctly synchronize the server time. I detected an offset of more than 5 minutes (by stopping ntpd and executing ntpdate).

After setting up the service I checked the setup via ntpstat:

[xxxx@xxx ~]$ ntpstat -q
synchronised to local net at stratum 11
time correct to within 10 ms
polling server every 1024 s

I repeated this check every day and it always showed this output. Doesn't this output tell me that the server time is sane?

EDIT: This is the output of ntpq -p

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 some.name       .LOCL.           1 u  685 1024  377    4.978  26263.4  93.465
 10.0.1.18       10.1.3.1         2 u  827 1024  377    1.382  26268.8 111.047
 10.0.1.21       .INIT.          16 u    - 1024    0    0.000    0.000   0.000
*LOCAL(0)        .LOCL.          10 l   10   64  377    0.000    0.000   0.001

Answer 1

Try ntpq -p -- This will list the peer associations ntpd is using. One of these should be marked with a * in the left margin: that's the one you're syncing to. If none are marked (or worse, none are listed) you're not syncing. ntpq can also do a lot of other useful diagnostics if you're willing to get down into the nasty bits of the NTP protocol (see ntpq(8) for more details, and what the other characters in the left margin mean).

Note that ntpd won't step your clock (the threshold for how much it will move your clock in any given window is relatively small). Starting ntpd with the -g flag will let it make a big adjustment when it starts (the other option is to run ntpdate -b to make the initial adjustment).

If you local clock is really lousy you have two options: Alexander's suggestion of running ntpdate out of cron (which solves a multitude of possible NTP problems) or setting the "panic" threshold to zero in ntp.conf which will let the daemon adjust the clock regardless of the offset. Note that both of these options come with the caveat that if your time server goes insane it will mess up the clock on your clients.