Debian 11 – system clock not synchronized and NTP drift – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Time drift causes TLS failures, cron misfires, and log correlation issues.

Environment & Reproduction

Often appears after VM resume, blocked UDP 123, or misconfigured NTP service.

cat /etc/os-release
timedatectl
systemctl status systemd-timesyncd --no-pager

Root Cause Analysis

System is not syncing with a reachable NTP source or has service conflicts.

Quick Triage

Check synchronization status and current peer reachability.

timedatectl show -p NTPSynchronized
chronyc tracking || true
ss -ulpn | grep ':123'

Step-by-Step Diagnosis

Validate NTP config, network reachability, and active daemon.

grep -R '^NTP=' /etc/systemd/timesyncd.conf
ping -c 2 time.cloudflare.com
journalctl -u systemd-timesyncd --since '1 hour ago'

Solution – Primary Fix

Set valid NTP servers, restart timesync service, and force resync.

sudo sed -i 's/^#NTP=.*/NTP=time.cloudflare.com time.google.com/' /etc/systemd/timesyncd.conf
sudo systemctl restart systemd-timesyncd
sudo timedatectl set-ntp true

Solution – Alternative Approaches

Deploy chrony for robust synchronization in variable network environments.

sudo apt install chrony -y
sudo systemctl enable --now chrony
chronyc sources -v

Verification & Acceptance Criteria

Clock is synchronized and drift remains within acceptable thresholds.

timedatectl
chronyc tracking || true
date -u

Rollback Plan

Revert to previous NTP service and configuration if issues persist.

sudo systemctl disable --now chrony || true
sudo systemctl restart systemd-timesyncd

Prevention & Hardening

Allow NTP traffic in firewall and monitor sync status.

sudo nft list ruleset | grep 123
timedatectl show -p NTPSynchronized

Related Errors & Cross-Refs

Related messages include clock unsynchronized and TLS certificate not yet valid.

Related tutorial: View the step-by-step tutorial for Debian 11.

View all Debian 11 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian time synchronization, systemd-timesyncd, and chrony documentation.