2

One of our DC's is our authoritative time server. The other DC's clock off that one. Then all other routers and machines clock off any DC. Some machines (no rhyme or reason, which ones) are off by 40 seconds. Is that reasonable or should everything be spot on?

squillman
  • 37,883
  • 12
  • 92
  • 146
Henry Lee
  • 121
  • 2

2 Answers2

3

Windows systems will have no issue authenticating as long as the time is within 5 minutes (by default).

However, you may find that you want your time to be more accurate for other purposes - personally, I like to have all devices within a second or so to make log correlation between devices possible.

Shane Madden
  • 114,520
  • 13
  • 181
  • 251
  • I agree. WAY too much can happen within 40 seconds that can make it hard to trace timing in logs and whatnot. – squillman Oct 13 '11 at 16:01
  • The windows goal is not to allow correlated logging but to allow good enough sync for.... kerberos. THAT SAID - I run comptuers on 3 locations and never have morethan 2-3 seconds skew. – TomTom Oct 13 '11 at 16:05
  • Thanks for the responses. We're trying to have it be more accurate for other purposes. I'm just trying to gauge how possible that is. – Henry Lee Oct 13 '11 at 16:06
  • @squillman: Just out of curiosity, what's the logic behind editing the words "Good day" and "Thanks" from the original post? – Henry Lee Oct 13 '11 at 16:24
  • 1
    @Henry It's a signal to noise thing that we have on the Stack Exchange sites. Greetings and signatures are discouraged as they detract from the actual content of the post. http://serverfault.com/faq#signatures – squillman Oct 13 '11 at 16:30
0

I see no reason why you would accept your servers being 40 seconds out of sync, even if it causes no immediate problems. If nothing else it is a clear sign that server time is drifting, and that it is on track to become even more off.

At work we have Nagios start complaining when the server time is one second off. Not because that one second itself is a big problem, but because it is enough to suggest that something isn't working properly. In my experience NTP is usually able to keep the offset within 10 ms, or so.

andol
  • 6,938
  • 29
  • 43