Time Synchronization of Guest O/S

[pearlyshells]

We were speaking with one of our hardware vendors about creating a VM for a Domain Time II Server. Here is what he said and I quote:

"a virtual guest OS is not suitable for use as a platform for providing time to other clients. Clock instability of the server machine can result in serious problems with time sychronization throughout your enterprise. Also, any tools that calculate time variances (such as Domain Time II Audit Server, Domain Time II Monitor Service, the Domain Time II Manager variance report, DTCheck utility, etc.) cannot be relied upon to provide accurate results when executed from a virtual OS. "

This was interesting but I wanted to be sure that the statement was, indeed, correct. Heck, I don't know but I usually don't take one person's word for it. So, I thought I'd check with more experienced folks in the Virtual World. Any comments?

[djciaro]

I would agree with the statement, use a physical box as a time server, it does not need to be a very powerful system.

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!

[pearlyshells]

It was an interesting statement. Don't know if I'd even consider devoting a VM for such a role but had never really thought about the impact of time synchronization between a host and guest. Just out of curiosity......what makes it "instable" ?

[jayolsen]

The idea is since the server is virtual it does not have 100% access to the CPU at all times to use the cycles to keep time.

To go back to your question of should you do it or not, I'm not sure. I bet there are some saying do it and others saying don't.

[msemon1]

VMware has not done a good job of clarifying the recommendation for time synchnoization for guest OS. There are advantages and disadvantages to synching your guests with the ESX host vs allowing your windows guests to get their time form the Domain Controller which is the PDC emulator. We are allowing are guests to synch with the PDC emulator and allowing windows to manage time. The PDC emulator is getting time from internal NTP server wehich is getting time from external NTP server. ESX hosts are also getting time from internal NTP server. so to answer your question you should not use a VM as an NTP server because of time drift issues. It should be a physical box.

Mike

[TomHowarth]

We were speaking with one of our hardware vendors about creating a VM for a Domain Time II Server. Here is what he said and I quote:

"a virtual guest OS is not suitable for use as a platform for providing time to other clients. Clock instability of the server machine can result in serious problems with time sychronization throughout your enterprise. Also, any tools that calculate time variances (such as Domain Time II Audit Server, Domain Time II Monitor Service, the Domain Time II Manager variance report, DTCheck utility, etc.) cannot be relied upon to provide accurate results when executed from a virtual OS. "

This was interesting but I wanted to be sure that the statement was, indeed, correct. Heck, I don't know but I usually don't take one person's word for it. So, I thought I'd check with more experienced folks in the Virtual World. Any comments?

I agree completely with that statement, an NTP server is a Real time device, the CPU slicing that occurs to allow mulitple OSes to utilise the same physical hardware causes havok with machine time. and can and does cause issues. Time keeping in a Virtual world (this is all flavours of i386 virtualization) can drift. and Windows hosts can drift one way and be recovered but not the other way. your master time source should always be phyiscal and pointing to a guarenteed time source, (ie an atomic clock) the question of whether you sync time with the host or a PDC is a matter of question. personally I sync my Hosts with a NTP server pointing to an atomic clock and my AD controller with the PDC Emulator to the same source, I then use Windows time management for my Windows servers, this prevents any Kerboros issues.

So to sum up do not havea time source as a virtual machine

If you found this or any other answer useful please consider the use of the Helpful or correct buttons to award points

Tom Howarth VCP / vExpert

VMware Communities User Moderator

Blog: www.planetvm.net

contributing author for the upcoming book "VMware Virtual Infrastructure Security: Securing ESX and the Virtual Environment”.

[arnoldthebat]

For reference, we have 1 stratum 1 physical time server, and 3 VMs running OpenBSD with openNTP implementations. Using the physical box as the most accurate time source, the VMs never vary more than 0.005 seconds from the physical box which is accurate enough for me!

One thing to remember is to set a low CPU reservation (ours is at 25Mhz) which is just a few ticks over the idling rate of the Open BSD servers) so no other CPU time from other servers can sken the underlying CPU time on the VMs.

[pearlyshells]

many thanks for the information. We use the PDC emulator to obtain Time from the Atomic Clock and then sync our ESX Hosts with the PDC Emulator. Our VMs then obtain time from the host.....

[atbnet]

We use a dedicated galleon gps ntp server http://www.galleon.eu.com/

Then all our servers, esx, switches get their time from this.

The main DC with PDC role uses this for its time which then relays the correct time to all member servers and computers though SNTP.

We dont use syncing the time to the ESX server.

Andy, VMware Certified Professional / VMware vExpert Award 2009

Help, Guides and How Tos

If you found this information useful please award points using the buttons at the top of the page accordingly.

[JoeLyons]

To me, your ntp server will sync off the internet, so depending on that interval your VM would be resonable up to date. We are talking about seconds here.

All depends on how critical yor time sync is to you? Landing planes - no, time stamp on my email - ok.

Personally as long as all my systems are on the same time I would have no problem witha little drift here and there.

Joe

Remember to back EVERYTHING up before you change ANYTHING

[msemon1]

A little drift is ok. A lot of drift then no authentication.

[TomHowarth]

why complicate matters, just let windows manage it own time. and leave the hosts out of it. unless you are using AD authentication for access to your ESX service consoles

If you found this or any other answer useful please consider the use of the Helpful or correct buttons to award points

Tom Howarth VCP / vExpert

VMware Communities User Moderator

Blog: www.planetvm.net

Contributing author for the upcoming book "VMware Virtual Infrastructure Security: Securing ESX and the Virtual Environment”.

[RParker]

The PDC emulator is getting time from internal NTP server wehich is getting time from external NTP server. ESX hosts are also getting time from internal NTP server. so to answer your question you should not use a VM as an NTP server because of time drift issues. It should be a physical box.

Very nice, well worded, concise, excellent. I agree.

[RParker]

why complicate matters, just let windows manage it own time. and leave the hosts out of it. unless you are using AD authentication for access to your ESX service consoles

Windows IS managing it's own time, it's a check box in Group Policy. Set it, done. It's not a huge configuration, but it's better to pre-set it to something you KNOW is accurate, Windows has a hard enough time figuring out which updates to pull you want it to randomly use something like time.nist.gov? If it's configured in Group Policy, I know it's accurate, and I control which time servers, not Windows.

Besides some shops may not have NTP at the firewall, so configuring it this way ensures correct time and time that's not blocked, and one less thing to get throw into the network...

[RParker]

0.005 seconds from the physical box which is accurate enough for me!

That should be enough for anyone!

[TomHowarth]

why complicate matters, just let windows manage it own time. and leave the hosts out of it. unless you are using AD authentication for access to your ESX service consoles

Windows IS managing it's own time, it's a check box in Group Policy. Set it, done. It's not a huge configuration, but it's better to pre-set it to something you KNOW is accurate, Windows has a hard enough time figuring out which updates to pull you want it to randomly use something like time.nist.gov? If it's configured in Group Policy, I know it's accurate, and I control which time servers, not Windows.

Besides some shops may not have NTP at the firewall, so configuring it this way ensures correct time and time that's not blocked, and one less thing to get throw into the network...

Richard by saying "let windows manage its own time" I meant as per my previous post PDC emulator pointst o NTP source. AD servers point to PDC server and member servers get time form AD. not Hosts. as you say it is a configurable setting in GPO and it is accurate.

If you found this or any other answer useful please consider the use of the Helpful or correct buttons to award points

Tom Howarth VCP / vExpert

VMware Communities User Moderator

Blog: www.planetvm.net

Contributing author for the upcoming book "VMware Virtual Infrastructure Security: Securing ESX and the Virtual Environment”.

[RParker]

Richard by saying "let windows manage its own time" I meant as per my previous post PDC emulator pointst o NTP source. AD servers point to PDC server and member servers get time form AD. not Hosts. as you say it is a configurable setting in GPO and it is accurate.

OH! So in other words we are saying the same thing

[TomHowarth]

that is pretty accurate, lets time it opps missed it, darn missed it again LOL seriously 5ms should be enough for all bar the most time sensitive of applications (atomic explosion simulators CERN etc)

If you found this or any other answer useful please consider the use of the Helpful or correct buttons to award points

Tom Howarth VCP / vExpert

VMware Communities User Moderator

Blog: www.planetvm.net

Contributing author for the upcoming book "VMware Virtual Infrastructure Security: Securing ESX and the Virtual Environment”.

[RParker]

(atomic explosion simulators CERN etc)

That's the irony, atomic bombs, really don't need to be that accurate in timing or distance.. So it was off by a few thousand feet and an hour.. How far do you think you are actually going to get? Go ahead get that head start, we only need 1 to ruin the day of the ENTIRE planet..hehe

[TomHowarth]

Yeah but you know those Scientists, they want to know the exact time that they ruined everybodies day. and also when they create the Black hole at CERN, who ever comes along after to find what ever is left would be able the tell the exact time we ceased to exist. it is important you know

If you found this or any other answer useful please consider the use of the Helpful or correct buttons to award points

Tom Howarth VCP / vExpert

VMware Communities User Moderator

Blog: www.planetvm.net

Contributing author for the upcoming book "VMware Virtual Infrastructure Security: Securing ESX and the Virtual Environment”.