NTP daemon running twice since latest update to ntp-4.2.8p6-8.2.

This document (7017621) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 11 Service Pack 4 (SLES 11 SP4)
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 12 Service Pack 1 (SLES 12 SP1)

Situation

Since the latest patch to ntp-4.2.8p6-8.2, two NTP processes will be started. This is because there has been an issue with asynchronous name resolution (ntp-fork.patch).

The new child process takes care of asynchronous name resolution on behalf of the parent. This was previously done by a thread, but that broke name resolution when running in a chrooted environment.

So when running NTP daemon, the following output will now be observed executing "ps aux | grep ntp" :

ntp 3661 0.0 0.2 36940 2464 ? Ss 09:38 0:00 /usr/sbin/ntpd -p /var/run/ntp/ntpd.pid -g -u ntp:ntp -i /var/lib/ntp -c /etc/ntp.conf
root 3669 0.0 0.1 34860 1404 ? S 09:38 0:00 /usr/sbin/ntpd -p /var/run/ntp/ntpd.pid -g -u ntp:ntp -i /var/lib/ntp -c /etc/ntp.conf

Resolution

This behavior is not considered a BUG, however a BUG report has still been raised with engineering to consider renaming the process table entry of the child to avoid future confusion about having one process run as root user, and the other process run as ntp user.

Cause

So this is a feature which improves NTP and not a BUG or security flaw.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.