RHEL 8 Chronyd Not Synchronizing Time With NTP Sources

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

RHEL 8 hosts report clock drift and chronyd remains unsynchronized. Kerberos, TLS validation, and distributed jobs fail due to timestamp skew, causing cascading authentication and scheduling issues.

Environment & Reproduction

Seen on restricted networks after NTP server or firewall policy changes. Reproduce by stopping and starting chronyd with invalid or unreachable upstream sources in chrony.conf.

Root Cause Analysis

Primary causes are blocked UDP 123, incorrect source definitions, or transient DNS failures. VM pause/resume behavior can also create prolonged offset without rapid correction settings.

Quick Triage

Run chronyc tracking and chronyc sources -v, verify systemctl status chronyd, inspect journalctl -u chronyd, and confirm firewalld outbound rules allow NTP traffic.

Step-by-Step Diagnosis

Validate each configured source with network tests, inspect reachability and stratum, and correlate chrony logs with network events. Check SELinux audit only if custom confinement impacts chronyd files.

Solution – Primary Fix

Correct chrony source entries, open required network paths in firewalld, restart chronyd with systemctl, and force a step when offset is large according to policy. Recheck synchronization metrics.

Solution – Alternative Approaches

Use internal NTP relays, add multiple geographically diverse sources, or configure hardware clock discipline for specific workloads that require tighter drift tolerance.

Verification & Acceptance Criteria

chronyc tracking should show synchronized status, low residual offset, and stable source reachability over multiple polling intervals.

Rollback Plan

Restore previous chrony.conf, reload service, and revert temporary step settings. If sync remains unstable, return to known-good internal source pools.

Prevention & Hardening

Monitor offset and source reachability, validate NTP policy in firewalld baselines, and test chrony behavior after hypervisor maintenance windows.

Related Errors & Cross-Refs

Related to Kerberos clock skew failures, TLS certificate validity errors, and scheduler drift incidents in clustered RHEL 8 environments.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

chrony and chronyc man pages, Red Hat time synchronization docs, firewalld network policy guides, and journalctl troubleshooting references.