[From nobody Wed Nov  4 16:17:07 2026
Received: (at submit) by bugs.debian.org; 21 Jun 2017 06:18:34 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.0-bugs.debian.org_2005_01_02
 (2014-02-07) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-14.9 required=4.0 tests=BAYES_00, FOURLA, HAS_PACKAGE,
 PGPSIGNATURE,SPF_HELO_PASS,SPF_PASS,T_RP_MATCHES_RCVD autolearn=ham
 autolearn_force=no version=3.4.0-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 9; hammy, 150; neutral, 135; spammy,
 0. spammytokens: hammytokens:0.000-+--H*u:2014-03-12,
 0.000-+--H*UA:2014-03-12, 0.000-+--H*u:1.5.23, 0.000-+--H*UA:1.5.23,
 0.000-+--H*c:pgp-sha512
Return-path: <debian.axhn@manchmal.in-ulm.de>
Received: from manchmal.in-ulm.de ([217.10.9.201])
 by buxtehude.debian.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.84_2) (envelope-from <debian.axhn@manchmal.in-ulm.de>)
 id 1dNYyI-000696-63
 for submit@bugs.debian.org; Wed, 21 Jun 2017 06:18:34 +0000
Date: Wed, 21 Jun 2017 08:18:28 +0200
From: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: monitoring-plugins-basic: check_ntp fails with stretch version of ntpd
Message-ID: <1498025879@msgid.manchmal.in-ulm.de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="wac7ysb48OaltWcw"
Content-Disposition: inline
User-Agent: Mutt/1.5.23 (2014-03-12)
Delivered-To: submit@bugs.debian.org


--wac7ysb48OaltWcw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Package: monitoring-plugins-basic
Version: 2.2-3
Severity: important

Dear Maintainer,

not unusual, I use check_ntp to probe a few ntp servers. After the
first of them was upgraded to stretch, the check fails with "NTP
CRITICAL: Offset unknown".

Some more investigation led me to the assumption ntpd implements a
strict rate limiting now, and check_ntp manages to trigger this.

How to repeat: Where $server is an ntpd in stretch, run (see #509359
why the LANG setting is necessary)

  LANG=C /usr/lib/nagios/plugins/check_ntp -4 -H $server -w 0.5 -c 0.8

Expected output (numbers may differ):

  NTP OK: Offset 0.001221060753 secs|offset=0.001221s;0.500000;0.800000;

Actual output:

  NTP CRITICAL: Offset unknown|

Running

  ntpdate -u -q $server

afterwards results in

  $time ntpdate[1234]: $server rate limit response from server.
  server $server, stratum 0, offset 0.000000, delay 0.00000

Also tcpdump shows pretty obvious the server just stops replying.


This affects both the jessie and stretch version of check_ntp, I haven't
checked older ones.

Although technically this could be worked around by changing the ntpd
configuration, I guess it's saner to address this in check_ntp, probably
by just placing a sleep in the right place. Please handle this in jessie
and stretch as well in a point release as people likely run their
monitoring applications on stable Debian releases.

Regards,

    Christoph

-- System Information:
Debian Release: 9.0
  APT prefers proposed-updates
  APT policy: (500, 'proposed-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.31 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: unable to detect

Versions of packages monitoring-plugins-basic depends on:
ii  iputils-ping               3:20161105-1
ii  libc6                      2.24-11+deb9u1
ii  libssl1.1                  1.1.0f-3
ii  monitoring-plugins-common  2.2-3
ii  procps                     2:3.3.12-3
ii  ucf                        3.0036

Versions of packages monitoring-plugins-basic recommends:
ii  libcap2-bin  1:2.25-1

Versions of packages monitoring-plugins-basic suggests:
pn  icinga | icinga2  <none>

-- no debconf information


--wac7ysb48OaltWcw
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJZSg+0AAoJEMQsWOtZFJL9ozIP/1AD8OrNLrs+g1nXj2ZEsRI7
M0vcpKQ8IsDxxfst7nT/+B59DnLYIzEN9ntTlw3F+Sz2hWAPuUCCrimI1PCEVNxS
sBq0chwhq3CexA2RQSOMqB3/5GpTOXYEpV9eiphWdahqM65nuWtoXXPrLpTxjKAs
lfPNPLjdHIR4Mbtmisb/ASvISu8PEmOrAA8OEL982SgXSCe90pBNdFK3o7FnGlyY
/U5wy9vRRPtmNL50Lbxg0oc+y8+rUlO9u1S7dXoxSo/lzKgqYuN7MXV+tP4EKXxA
E+g4s4753K9a1fwtILppKh0NaO8bkVBKDW/irturtSiVbv3sozgQFoc3/G1BWtB3
RbG+ZG1BnfavHcaRqdeLyUwjVKsCAfzIIVeMfkUfaUa5UWGPUIhPJaxFVv+8r3Ge
S/rLtb4+3+AbTT50ixz+EBJXbscq/ARR/oFzGtNfXeJSSkbPkQG2+plpCVfAfa+n
lqUuavLN7IORYh//AZGdRyzNQw1TQU9g+rCS1XoMCrSnZvn4gSdWN1M5KERLXdDR
XaYpmLkL/lN/QME7qDY61qm+hjWZoOLf1gzmYw6NFeVt/e7OzTuStOtM3gU6wCDz
8BJK544CNYm/28wnFQCLPUJPZXMyDaOXKAvOpdFJDjBbIcC77b2k9IoDK6BHaE6F
ibZzhzVFMg+a5HnhXGs3
=eytp
-----END PGP SIGNATURE-----

--wac7ysb48OaltWcw--
]