Time synchronization with NTP

Incorrect time on a Linux server causes problems you might not expect: TLS certificate validation fails, log timestamps are useless, database replication breaks, and cron jobs run at the wrong times. Keeping time synchronized is a basic but important task.

Why time matters

TLS certificates — validation depends on accurate time. A clock off by 5 minutes can reject valid certificates.
Log correlation — comparing logs across servers only works if clocks are synced.
Database replication — many replication mechanisms depend on timestamps.
Kerberos — authentication fails if clocks differ by more than 5 minutes.
Cron jobs — scheduled tasks run based on system time.

chrony

chrony is the modern NTP implementation and the default on Ubuntu 16.04+. It’s faster and more accurate than the older ntpd.

Check if it’s running:

systemctl status chrony

Check time sources and status:

chronyc sources -v
chronyc tracking

Configuration is in /etc/chrony/chrony.conf. Default servers usually work:

server 0.pool.ntp.org iburst
server 1.pool.ntp.org iburst
server 2.pool.ntp.org iburst
server 3.pool.ntp.org iburst

iburst sends a burst of packets on initial sync for faster startup.

Force an immediate sync:

sudo chronyc makestep

systemd-timesyncd

A simpler NTP client built into systemd. It only syncs time (doesn’t serve as a server).

Check status:

timedatectl status

Set the NTP server in /etc/systemd/timesyncd.conf:

[Time]
NTP=0.pool.ntp.org 1.pool.ntp.org

Enable and restart:

sudo systemctl enable systemd-timesyncd
sudo systemctl restart systemd-timesyncd

timedatectl

The central command for time management:

timedatectl                        # show current time and settings
timedatectl set-timezone UTC       # set timezone
timedatectl set-time "2024-01-15 10:30:00"  # set time manually
timedatectl set-ntp true           # enable NTP sync

List available timezones:

timedatectl list-timezones | grep Asia

Set a timezone:

sudo timedatectl set-timezone Asia/Jakarta

Choosing between chrony and systemd-timesyncd

chrony is better for:

Servers that need accurate time
Systems that serve time to other clients
Environments with intermittent network connectivity

systemd-timesyncd is fine for:

Desktop systems
Simple server setups
When you want one less daemon running

Don’t run both simultaneously — they’ll conflict.

Hardware clock

The hardware clock (RTC) keeps time when the system is off. Sync it:

sudo hwclock --systohc    # system → hardware
sudo hwclock --hctosys    # hardware → system

Check hardware clock:

sudo hwclock --show

Troubleshooting

Check if NTP is working:

chronyc tracking

Look at the “System time” offset. Ideally it’s under a few milliseconds.

Check which servers you’re synced to:

chronyc sources

A * means the current preferred source. + means acceptable. - means rejected.

Test NTP connectivity:

ntpdate -q 0.pool.ntp.org

If time is way off, force a step:

sudo chronyc makestep
sudo systemctl restart chrony

Common mistakes

Running both chrony and ntpd/timesyncd. Pick one. Running multiple NTP clients causes conflicts.

Not setting the timezone. UTC is fine for servers, but make sure it’s intentional. timedatectl shows the current timezone.

Ignoring time drift on VMs. Virtual machines are notorious for clock drift. chrony handles this better than ntpd.

Large initial offset. If the clock is off by more than a few seconds, chrony might not step automatically. Use chronyc makestep to force it.

Remarks

Time synchronization is one of those things that works until it doesn’t, and when it doesn’t, the symptoms are confusing. TLS errors, log mismatches, authentication failures — all can be caused by clock skew. Install chrony, verify it’s running, and check the offset occasionally. On VMs, check more often.