How to Sync Time with Chrony on RHEL 7
Accurate system time is critical for nearly every networked service on a Linux server. Log correlation, SSL certificate validation, Kerberos authentication, database replication, and distributed systems all depend on clocks that are closely synchronized across machines. Red Hat Enterprise Linux 7 ships with Chrony as the default NTP implementation, replacing the older ntpd daemon. Chrony is specifically designed for systems that are not always online, that change network connectivity frequently, or that need to synchronize quickly after being powered off — making it ideal for both physical servers and virtual machines. This tutorial walks through installing, configuring, and verifying time synchronization with Chrony on RHEL 7.
Prerequisites
- A RHEL 7 system with root or sudo access
- Internet access or access to an internal NTP server
- A registered RHEL 7 subscription (for
yumpackage installation) or a configured local repository
Step 1: Understand Chrony vs. ntpd on RHEL 7
On RHEL 6 and earlier, ntpd was the standard NTP daemon. RHEL 7 ships with Chrony as the default and preferred solution. The two cannot run simultaneously — if both are installed, only one should be enabled at a time.
Key advantages of Chrony over ntpd for typical server use:
- Synchronizes the clock much faster after boot or a long offline period
- Maintains better accuracy on machines with variable network latency
- Works well in virtualized environments where the clock can drift significantly
- Does not require a persistent network connection
Check whether ntpd is running and disable it if so before proceeding:
sudo systemctl status ntpd
sudo systemctl stop ntpd
sudo systemctl disable ntpdAlso ensure ntpdate is not configured to run via cron, as it can conflict with Chrony:
sudo systemctl disable ntpdate 2>/dev/null; trueStep 2: Install Chrony
Chrony is included in the RHEL 7 base repositories and is typically pre-installed on minimal installations. Check whether it is already present:
rpm -q chronyIf it is not installed, install it with yum:
sudo yum install chrony -yVerify the installation:
rpm -qi chronyStep 3: Configure /etc/chrony.conf
The main configuration file for Chrony is /etc/chrony.conf. Open it in a text editor:
sudo vi /etc/chrony.confThe default configuration on RHEL 7 uses the RHEL NTP pool servers. A typical well-configured file looks like this:
# Use the RHEL NTP pool or your organization's internal NTP servers
server 0.rhel.pool.ntp.org iburst
server 1.rhel.pool.ntp.org iburst
server 2.rhel.pool.ntp.org iburst
server 3.rhel.pool.ntp.org iburst
# Alternatively, use the general NTP pool:
# pool 2.pool.ntp.org iburst
# Record the rate at which the system clock gains/loses time
driftfile /var/lib/chrony/drift
# Allow the system clock to be stepped in the first three updates
# if its offset is larger than 1 second
makestep 1.0 3
# Enable kernel synchronization of the real-time clock (RTC)
rtcsync
# Allow NTP client access from local network (optional, for local NTP server role)
# allow 192.168.1.0/24
# Serve time even if not synchronized to a time source
# local stratum 10
# Specify file containing keys for NTP authentication
# keyfile /etc/chrony.keys
# Specify directory for log files
logdir /var/log/chronyThe iburst option tells Chrony to send a burst of packets when initially contacting a server, which speeds up the initial synchronization significantly. If you have an internal NTP server (common in enterprise environments), replace the pool entries with your internal server’s address:
server ntp.internal.example.com iburstSave and close the file when done.
Step 4: Enable and Start the chronyd Service
Enable the chronyd service to start automatically at boot, then start it immediately:
sudo systemctl enable chronyd
sudo systemctl start chronydVerify the service is running:
sudo systemctl status chronydExpected output should show active (running):
● chronyd.service - NTP client/server
Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2026-05-17 10:00:00 UTC; 5s ago
Process: 1234 ExecStartPost=/usr/libexec/chrony-helper update-daemon (code=exited, status=0/SUCCESS)
Main PID: 1230 (chronyd)
CGroup: /system.slice/chronyd.service
└─1230 /usr/sbin/chronydStep 5: Verify Time Synchronization with chronyc
The chronyc command-line client allows you to query and interact with the running chronyd daemon. The two most useful commands for verifying synchronization are tracking and sources.
Check the current tracking status:
chronyc trackingExample output:
Reference ID : 78563412 (ntp1.example.com)
Stratum : 2
Ref time (UTC) : Sun May 17 10:00:05 2026
System time : 0.000123456 seconds slow of NTP time
Last offset : -0.000012345 seconds
RMS offset : 0.000045678 seconds
Frequency : -12.345 ppm slow
Residual freq : -0.001 ppm
Skew : 0.123 ppm
Root delay : 0.012345678 seconds
Root dispersion : 0.000123456 seconds
Update interval : 64.2 seconds
Leap status : NormalKey fields to understand:
- Stratum: Distance from a reference clock (stratum 1 = directly connected to hardware clock; lower is better)
- System time: How far the local clock is from the NTP reference
- Leap status: Normal: No leap second adjustment in progress — this is what you want
Check the NTP sources being used:
chronyc sources -vExample output:
210 Number of sources = 4
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| | | zzzz = estimated error.
|| | |
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 203.0.113.10 2 6 377 45 -0.123ms[+0.234ms] +/- 15ms
^+ 203.0.113.11 2 6 377 44 +1.234ms[+1.345ms] +/- 18ms
^- 203.0.113.12 3 6 377 46 +5.678ms[+5.789ms] +/- 22ms
^+ 203.0.113.13 2 6 377 47 -2.345ms[+0.123ms] +/- 16msThe * symbol next to a source means it is the currently selected reference. A + means it is a backup source being combined. If all sources show ?, the server cannot reach any NTP peers — check your network and firewall (UDP port 123 must be open outbound).
Step 6: Manage Time Settings with timedatectl
RHEL 7 also provides timedatectl, a systemd utility for viewing and managing time, timezone, and NTP status:
timedatectl statusExample output:
Local time: Sun 2026-05-17 10:05:30 UTC
Universal time: Sun 2026-05-17 10:05:30 UTC
RTC time: Sun 2026-05-17 10:05:30
Time zone: UTC (UTC, +0000)
NTP enabled: yes
NTP synchronized: yes
RTC in local TZ: no
DST active: n/aTo set the timezone on a RHEL 7 server (UTC is recommended for servers):
# List available timezones
timedatectl list-timezones | grep America
# Set a specific timezone
sudo timedatectl set-timezone America/New_York
# Or set UTC
sudo timedatectl set-timezone UTCTo enable or disable NTP synchronization via timedatectl (when Chrony is managing NTP, this should remain enabled):
sudo timedatectl set-ntp trueStep 7: Open the Firewall for NTP (If Acting as an NTP Server)
If this RHEL 7 machine is acting as an NTP server for other clients on your network, you need to open UDP port 123 in firewalld:
sudo firewall-cmd --permanent --add-service=ntp
sudo firewall-cmd --reload
sudo firewall-cmd --list-servicesAlso ensure the allow directive is set in /etc/chrony.conf to permit client access from your subnet.
Time synchronization with Chrony on RHEL 7 is straightforward once you understand the configuration file, the chronyc commands, and how timedatectl integrates with the NTP layer. A well-synchronized clock is one of those invisible services that you only notice when it breaks — taking the time to configure it properly prevents a wide class of subtle, hard-to-diagnose issues across your infrastructure.
