A data centre runs thousands of devices — servers, hypervisors, storage arrays, switches, firewalls and security appliances — and every one of them keeps its own clock. Left alone, those clocks drift apart by seconds a day. Network Time Protocol (NTP) keeps them aligned, and the quality of the time source behind it decides how far you can trust every timestamp the data centre produces.
Why time accuracy matters in a data centre
Log correlation. Investigating an incident means lining up events from firewalls, servers, applications and access-control systems. If their clocks disagree, the sequence of events is unreliable, and a security information and event management (SIEM) system cannot correlate them correctly.
Authentication. Kerberos, used by Microsoft Active Directory and many enterprise systems, rejects requests when the clocks of client and server differ by more than a set tolerance — five minutes by default. Clock drift can therefore lock users out.
Certificates and encryption. TLS certificates are only valid between two dates. A device whose clock is wrong can reject valid certificates or accept expired ones.
Distributed systems. Databases, storage replication and scheduled jobs use timestamps to order events and resolve conflicts. Consistent time across nodes avoids subtle data errors.
Building a reliable time hierarchy
The standard design places one or more Stratum 1 time servers, referenced to GPS, at the top of the hierarchy inside the data centre. Core infrastructure — domain controllers, core switches, hypervisor hosts — synchronizes from them, and the remaining devices synchronize from that layer or directly from the time servers.
Plan for redundancy. Use at least two GPS time servers, ideally in different racks and on different power feeds, so maintenance or a hardware fault never leaves the network without a reference. NTP's selection algorithm compares several sources and discards one that disagrees with the rest; NTP best-practice guidance (RFC 8633) recommends configuring clients with at least four sources so that a faulty one can be outvoted.
On-premise GPS time vs. internet time
Public internet time servers are convenient, but they make your time depend on internet connectivity, on network paths you don't control, and on firewall rules that allow outbound NTP. An on-premise GPS NTP time server keeps the whole data centre on time even if the internet link is down, and it works in isolated or air-gapped networks where internet time is not an option. If GPS reception is ever interrupted, a good time server keeps time on its internal oscillator; see our guide to GNSS jamming, spoofing and holdover.
Virtual machines
Virtual machines are prone to clock drift, because they share CPU time with other workloads and can be paused or migrated between hosts. Synchronize the hypervisor hosts to your NTP servers, and follow your hypervisor vendor's guidance for guest time synchronization, so that two mechanisms are never adjusting the same clock at once.
Securing NTP
Restrict which networks may query your time servers, disable NTP monitoring and control queries from untrusted networks, and keep the servers on a management network or VLAN. Where clients support it, Network Time Security (NTS, RFC 8915) lets them verify that time really comes from your server and has not been altered; symmetric-key authentication is an older alternative. The ORNATE 7000 TSDR Series supports NTS.
Monitoring
Time problems are silent until something breaks, so monitor them. Alert when a server loses GPS lock, when a client's offset grows, or when a device's stratum changes unexpectedly. Our Management Server Software shows sync status and drift for every time server and clock on one dashboard, and the ORNATE 7000 TSDRNPT shows GPS lock and client status on its front-panel display.
When NTP is not enough
NTP is the right protocol for almost every data centre workload. Applications that need sub-microsecond agreement, such as financial trading or some telecom systems, use the Precision Time Protocol instead; see NTP vs PTP. The ORNATE 7000 TSDRNT outputs both from the same GPS reference.
Related products
ORNATE 7000 TSDRNPT GPS time server → ORNATE 7000 TSDR Series (NTS) → All NTP time servers →