TMA-COCKROACHDB-2.1
Ensure Network Time Protocol (NTP) Service Is Configured for Cluster Clock Synchronization
설명
CockroachDB requires moderate levels of clock synchronization to preserve data consistency. When a node detects that its clock is out of sync with at least half of the other nodes in the cluster by 80% of the maximum offset allowed (500 ms by default), it will spontaneously shut down to avoid consistency anomalies.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
On each node confirm exactly one clock-sync service (chronyd, ntpd, or the cloud provider time source) is enabled and running (systemctl status chronyd, timedatectl, chronyc sources -v). All nodes must use compatible leap-smearing sources, and offsets must stay well within --max-offset (default 500ms).
조치 방법
조치 방식: 가이드 또는 인프라 패치
Key requirements: - Run one clock sync service (NTP/chrony or provider's built-in time source) on each node. - Use compatible, leap-smearing time sources across all nodes. 1. Install and enable a time sync service (per environment): - AWS EC2: Configure each instance to use Amazon Time Sync Service via 169.254.169.123, verify via chronyc sources -v. - GCE: use GCE's internal NTP via metadata.google.internal;
속성
- 운영 체제
- 모두
- 태그
- cockroachdbtime
- 참고 자료
- CIS CockroachDB v25.x Benchmark v1.0.0 - 2.1 Ensure Network Time Protocol (NTP) Service Is Configured for Cluster Clock Synchronization