> We use redundant time servers in each of our datacenters, and we'd like to actively switch away from time servers before their scheduled reboots, because the estimated error that accumulates on our clients while waiting to notice that a server has gone away can be too high for our standards..
Are the clients connecting to all of the redundant servers? If so,
losing connectivity to one shouldn't have much impact since the others
will still be working.
Clients are always connected to two servers in the same/nearest available datacenter, and to several backup servers elsewhere. We use "trust" and "prefer" flags on the near two. When one goes away, clients take about 10 minutes to switch. For regulatory reasons, we care about 100us deviations, which is < 0.2 ppm over 10 minutes.