RHEL 7 time drift caused by chronyd service not active

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Authentication tokens expire unexpectedly, distributed jobs fail, and logs become hard to correlate across hosts. Time drift impacts security, scheduling, and troubleshooting fidelity.

Environment & Reproduction

Seen after disabling chronyd, changing NTP sources, or blocking UDP 123 via firewalld. Reproduce by stopping chronyd and observing increasing offset with timedatectl and chronyc tracking.

Root Cause Analysis

Without active synchronization, system clock drifts based on hardware oscillator variance. Network restrictions or misconfigured servers prevent chronyd from maintaining accurate time discipline.

Quick Triage

Check systemctl status chronyd, chronyc sources, and timedatectl output. Verify firewalld permits NTP traffic and inspect journalctl -u chronyd for connectivity or source selection errors.

Step-by-Step Diagnosis

Measure current offset, validate configured NTP peers, and test reachability. Identify whether issue is service state, network policy, or bad server configuration by reviewing chronyd logs in journalctl.

Solution – Primary Fix

Enable and start chronyd with systemctl enable –now chronyd or service chronyd start, correct /etc/chrony.conf sources, and allow NTP through firewalld as required.

Solution – Alternative Approaches

Use internal stratum servers, deploy fallback peers, or apply one-time clock correction before service resume on heavily drifted systems to reduce application shock during resync.

Verification & Acceptance Criteria

chronyc tracking should report low offset and selected sources. Authentication and scheduled jobs must stabilize. journalctl should show periodic successful source polling without errors.

Rollback Plan

If synchronization introduces regressions, revert chrony source changes and return to previous trusted NTP set. Keep chronyd active unless emergency policy requires temporary stop.

Prevention & Hardening

Monitor drift metrics, enforce chronyd enabled state, and validate NTP reachability after firewall updates. Document service management using both systemctl and service for legacy operations.

Related Errors & Cross-Refs

Related symptoms include Kerberos failure due to clock skew and TLS validation anomalies. Cross-reference network ACLs, firewalld updates, and upstream NTP health events.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

See chrony.conf, chronyc, and Red Hat time synchronization guidance. Include timing dependency notes for identity, certificates, and distributed job schedulers.