[chrony-users] chrony-top

[Marc Compere]

Hello,

I've accidentally made a chrony-top like application. It is a simple python
script that uses successive output of `chronyc -n clients` to detect which
IP addresses are (a) found in two successive reports and (b) have an
increasing NTP request count.

I made this to detect the offending IP address during sporadic periods of
unusually high NTP request activity. It turns out it detects the very high
users but also updates with typical user's NTP requests over a period of 5
to 10 seconds.

It updates the console screen every dt seconds with IPs from the most
recent highest NTP requests.

Can someone try this out and let me know if it works? It works on Ubuntu
20.04.2 quite well and reports something similar to the attached screenshot:
[image: chrony_top_screenshot.png]

It must be run as sudo or root, so make sure you read the script before
executing. It's simple and short. It makes a folder in /tmp to save output
from `chronyc -nc clients`.

MDC

[Miroslav Lichvar]

Post by Marc Compere
Can someone try this out and let me know if it works? It works on Ubuntu
[image: chrony_top_screenshot.png]
It must be run as sudo or root, so make sure you read the script before
executing. It's simple and short. It makes a folder in /tmp to save output
from `chronyc -nc clients`.

Interesting, thanks for posting.

I tried it on one of my servers which is logging 512k clients at the
same time and the script was a bit too heavy on the CPU. It takes a
long time to fetch all the clients and then sort them.

In recent chrony versions the clients command has the -r option to
reset the counters and the -p option to select clients that has at
least some number of accesses. Together, they can make an efficient
top-like utility, e.g.:

#!/bin/sh

#reset counters
chronyc -n clients -r -p -1 > /dev/null

while true; do
sleep 1
echo
chronyc -c clients -r -p 1 | \
awk -F , '{ printf "%40s\t%d\n", $1, $2 }' | \
sort -n -r -k 2 | \
head -n 20
done

The obvious drawback is that it's constantly resetting all the
counters, so there must be nothing else using them.
--
Miroslav Lichvar