Chrony time synchronization not working

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Clock drift causes authentication failures, certificate errors, and inconsistent logs across nodes.

Environment & Reproduction

RHEL 8 server with `chronyd` enabled but not syncing after startup.

Root Cause Analysis

Blocked UDP 123, unreachable NTP sources, bad `chrony.conf`, or virtualization host clock instability.

Quick Triage

Check `systemctl status chronyd` and current sync state using `chronyc tracking`.

Step-by-Step Diagnosis

Run `chronyc sources -v`, review `journalctl -u chronyd`, and validate firewall/network path for NTP traffic.

Solution – Primary Fix

Configure reachable time sources in `chrony.conf`, open UDP 123 if needed, restart `chronyd`, and verify lock status.

Solution – Alternative Approaches

Use internal stratum servers or `iburst` fallback pools for faster initial synchronization.

Verification & Acceptance Criteria

`chronyc tracking` reports synchronized and offset remains within operational tolerance.

Rollback Plan

Restore prior `chrony.conf` and source list if new servers introduce unstable offset swings.

Prevention & Hardening

Standardize approved NTP sources and monitor drift/stratum metrics centrally.

Related Errors & Cross-Refs

Kerberos clock skew failures, TLS not yet valid errors, and cross-node log timestamp mismatch.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

`chronyc(1)`, `chrony.conf(5)`, and RHEL time synchronization recommendations.