Debian 11: chrony not syncing and system clock drift

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Time synchronization is unhealthy, causing drift that affects authentication and scheduled workloads.

Environment & Reproduction

Clock skew alerts appear and TLS, Kerberos, or token-based workflows intermittently fail.

Root Cause Analysis

Run `chronyc tracking`, `chronyc sources -v`, and verify UDP 123 reachability to configured servers.

Quick Triage

Unreachable NTP sources, firewall restrictions, or invalid chrony configuration.

Step-by-Step Diagnosis

Update `/etc/chrony/chrony.conf` with reachable trusted sources and restart chrony service.

Solution – Primary Fix

Confirm low offset and normal stratum in `chronyc tracking` and stable source selection.

Solution – Alternative Approaches

Use at least three resilient time sources and monitor offset thresholds continuously.

Verification & Acceptance Criteria

Revert to prior chrony config and restart service if new sources degrade stability.

Rollback Plan

Create an alert when chrony reports unsynchronized status for more than one polling cycle.

Prevention & Hardening

`chronyc tracking`; `chronyc sources -v`; `systemctl status chrony`

Related Errors & Cross-Refs

Share offset history, chrony logs, and network ACL details for timing infrastructure review.

Related tutorial: View the step-by-step tutorial for debian-11.

View all debian-11 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Virtualized environments can introduce additional drift if host clock discipline is weak.