RHEL 10 – Chrony not synchronizing system time with NTP sources – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Clock drift causes authentication failures, certificate validation errors, and scheduler anomalies.

Environment & Reproduction

Appears in restricted networks or after firewall rule changes.

systemctl status chronyd
chronyc tracking
chronyc sources -v

Root Cause Analysis

NTP egress blocking, invalid server entries, or service disablement commonly prevent sync.

Quick Triage

Assess chronyd health and network reachability.

journalctl -u chronyd -n 60
firewall-cmd --list-services
chronyc activity

Step-by-Step Diagnosis

Validate chrony.conf and UDP/123 flow to upstream peers.

grep -E '^(server|pool)' /etc/chrony.conf
firewall-cmd --query-service=ntp
chronyc sourcestats -v

Solution – Primary Fix

Enable chronyd, allow NTP service in firewall, and step clock if needed.

systemctl enable --now chronyd
firewall-cmd --add-service=ntp --permanent
firewall-cmd --reload
chronyc makestep

Solution – Alternative Approaches

Use internal stratum servers or temporary one-time sync for recovery windows.

chronyd -q 'server ntp.internal iburst'
timedatectl set-ntp true

Verification & Acceptance Criteria

System reports synchronized and offset remains within policy limits.

timedatectl status
chronyc tracking
chronyc sources -v

Rollback Plan

Revert chrony.conf and firewall change set if policy requires different time source paths.

cp -a /root/chrony.conf.bak /etc/chrony.conf
firewall-cmd --remove-service=ntp --permanent
firewall-cmd --reload

Prevention & Hardening

Monitor drift and source health with routine checks and alert thresholds.

systemctl is-enabled chronyd
chronyc tracking | tee /var/log/chrony-health.log

Related Errors & Cross-Refs

Often linked to Kerberos skew errors and TLS handshake failures.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL chrony and time synchronization operational best practices.