Chrony Time Sync: Complete Guide & Implementation

Master Chrony NTP implementation with this comprehensive guide covering installation, configuration, monitoring, and optimization techniques.

Author:

Published:

Category: System Administration

Reading Time: 12

Chrony Time Synchronization: Complete Guide and Implementation

Table of Contents

1. [Introduction](#introduction) 2. [Architecture and Components](#architecture-and-components) 3. [Installation](#installation) 4. [Configuration](#configuration) 5. [Commands and Operations](#commands-and-operations) 6. [Monitoring and Troubleshooting](#monitoring-and-troubleshooting) 7. [Advanced Configuration](#advanced-configuration) 8. [Security Considerations](#security-considerations) 9. [Performance Optimization](#performance-optimization) 10. [Best Practices](#best-practices)

Introduction

Chrony is a versatile implementation of the Network Time Protocol (NTP) designed for systems that are not online all the time or have intermittent network connectivity. It consists of two main programs: chronyd (the daemon) and chronyc (the command-line interface). Chrony is particularly effective at synchronizing system clocks with high accuracy and can adapt quickly to changing network conditions.

Key Features

| Feature | Description | |---------|-------------| | Fast Convergence | Quickly synchronizes time even after long periods offline | | Intermittent Connectivity | Handles networks with variable connectivity well | | Low Resource Usage | Minimal CPU and memory footprint | | Hardware Timestamping | Supports hardware timestamping for improved accuracy | | Flexible Configuration | Extensive configuration options for various scenarios | | Security Features | Authentication and access control capabilities |

Advantages over Traditional NTP

| Aspect | Chrony | Traditional NTP | |--------|--------|-----------------| | Startup Time | Fast synchronization on startup | Slower initial synchronization | | Offline Handling | Maintains accuracy during offline periods | Less effective offline handling | | Virtual Machines | Better performance in virtualized environments | May struggle with VM time drift | | Mobile Devices | Optimized for intermittent connectivity | Designed for always-on systems | | Memory Usage | Lower memory footprint | Higher resource consumption |

Architecture and Components

Core Components

chronyd (Daemon) The chronyd daemon is the core component responsible for: - Maintaining system clock synchronization - Communicating with NTP servers - Handling local clock adjustments - Managing reference sources - Providing time services to clients

chronyc (Client) The chronyc client provides: - Command-line interface for daemon control - Real-time monitoring capabilities - Configuration management - Diagnostic tools

Process Flow

` ┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐ │ NTP Servers │───▶│ chronyd │───▶│ System Clock │ └─────────────────┘ │ (Daemon) │ └─────────────────┘ └──────────────────┘ │ ▼ ┌──────────────────┐ │ chronyc │ │ (Client) │ └──────────────────┘ `

Installation

Red Hat/CentOS/Fedora Systems

`bash

Install chrony package

sudo dnf install chrony

For older systems using yum

sudo yum install chrony

Enable and start the service

sudo systemctl enable chronyd sudo systemctl start chronyd

Verify installation

rpm -qa | grep chrony `

Debian/Ubuntu Systems

`bash

Update package repository

sudo apt update

Install chrony

sudo apt install chrony

Enable and start the service

sudo systemctl enable chrony sudo systemctl start chrony

Verify installation

dpkg -l | grep chrony `

SUSE/openSUSE Systems

`bash

Install chrony package

sudo zypper install chrony

Enable and start the service

sudo systemctl enable chronyd sudo systemctl start chronyd `

Verification Commands

`bash

Check service status

sudo systemctl status chronyd

Verify chrony is running

ps aux | grep chronyd

Check listening ports

sudo netstat -tulpn | grep chronyd

View basic synchronization status

chronyc tracking `

Configuration

Main Configuration File

The primary configuration file is located at /etc/chrony.conf (or /etc/chrony/chrony.conf on some distributions).

Basic Configuration Structure

`bash

/etc/chrony.conf

NTP Server Configuration

server 0.pool.ntp.org iburst server 1.pool.ntp.org iburst server 2.pool.ntp.org iburst server 3.pool.ntp.org iburst

Drift file location

driftfile /var/lib/chrony/drift

Real-time clock configuration

rtcsync

Step threshold

makestep 1.0 3

Allow NTP client access

allow 192.168.1.0/24

Logging configuration

logdir /var/log/chrony log measurements statistics tracking `

Configuration Directives Explained

| Directive | Purpose | Example | |-----------|---------|---------| | server | Specify NTP servers | server pool.ntp.org iburst | | pool | Use server pools | pool pool.ntp.org iburst | | driftfile | Clock drift storage | driftfile /var/lib/chrony/drift | | rtcsync | Sync hardware clock | rtcsync | | makestep | Step threshold | makestep 1.0 3 | | allow | Client access control | allow 192.168.0.0/16 | | deny | Deny access | deny all | | local | Local reference | local stratum 10 |

Server Configuration Options

`bash

Basic server configuration

server time.example.com

Server with options

server time.example.com iburst minpoll 4 maxpoll 10 maxdelay 0.1

Prefer specific server

server primary.ntp.org prefer iburst

Pool configuration

pool pool.ntp.org iburst maxsources 4 `

Server Option Parameters

| Option | Description | Default Value | |--------|-------------|---------------| | iburst | Send burst of packets on startup | N/A | | minpoll | Minimum polling interval (log2 seconds) | 6 (64 seconds) | | maxpoll | Maximum polling interval (log2 seconds) | 10 (1024 seconds) | | maxdelay | Maximum acceptable delay | No limit | | maxdist | Maximum acceptable dispersion | No limit | | prefer | Prefer this source | N/A | | trust | Trust this source | N/A | | require | Require this source | N/A |

Access Control Configuration

`bash

Allow access from local network

allow 192.168.1.0/24 allow 10.0.0.0/8

Deny access from specific hosts

deny 192.168.1.100

Allow all (not recommended for security)

allow all

Deny all except explicitly allowed

deny all allow 127.0.0.1 allow ::1 `

Logging Configuration

`bash

Set log directory

logdir /var/log/chrony

Enable specific log types

log measurements statistics tracking refclocks tempcomp

Log file rotation

logbanner 32

Detailed logging options

log measurements # Records time measurements log statistics # Records statistical information log tracking # Records tracking information log rtc # Records RTC information log refclocks # Records reference clock information `

Commands and Operations

chronyc Command Structure

`bash

Basic syntax

chronyc [options] [command]

Interactive mode

chronyc

Non-interactive mode

chronyc "command" `

Essential chronyc Commands

#### System Status Commands

`bash

Display tracking information

chronyc tracking

Show current time sources

chronyc sources

Verbose source information

chronyc sources -v

Show source statistics

chronyc sourcestats

Display system activity

chronyc activity `

#### Time Synchronization Commands

`bash

Force immediate synchronization

chronyc makestep

Manually adjust time

chronyc manual on chronyc manual off

Burst mode for faster sync

chronyc burst 4/4

Online/offline source control

chronyc online [source] chronyc offline [source] `

#### Monitoring Commands

`bash

Display current system clock status

chronyc tracking

Show NTP measurements

chronyc ntpdata [source]

Display authentication information

chronyc authdata

Show client connections

chronyc clients

Display server statistics

chronyc serverstats `

Command Output Interpretation

#### chronyc tracking Output

`bash $ chronyc tracking Reference ID : A29FC87B (pool-162-159-200-123.bstnma.fios.verizon.net) Stratum : 3 Ref time (UTC) : Thu Dec 07 15:30:45 2023 System time : 0.000123456 seconds fast of NTP time Last offset : -0.000087654 seconds RMS offset : 0.000234567 seconds Frequency : 15.432 ppm slow Residual freq : -0.003 ppm Skew : 0.012 ppm Root delay : 0.023456789 seconds Root dispersion : 0.001234567 seconds Update interval : 64.2 seconds Leap status : Normal `

| Field | Description | |-------|-------------| | Reference ID | IP or identifier of current reference | | Stratum | Distance from primary time source | | System time | Current offset from NTP time | | Last offset | Most recent time adjustment | | RMS offset | Root mean square of recent offsets | | Frequency | Clock frequency adjustment | | Root delay | Network delay to reference | | Update interval | Time between updates |

#### chronyc sources Output

`bash $ chronyc sources 210 Number of sources = 4 MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^+ time.cloudflare.com 3 6 377 45 -1234us[-1234us] +/- 15ms ^* pool-1.ntp.org 2 6 377 46 +567us[ +890us] +/- 25ms ^+ ntp.ubuntu.com 3 7 377 92 -2345us[-2345us] +/- 35ms ^? time.nist.gov 1 6 377 123 +123us[ +123us] +/- 45ms `

| Symbol | Meaning | |--------|---------| | ^* | Current best source | | ^+ | Good source, combined with best | | ^? | Source with questionable accuracy | | ^x | False ticker, discarded | | ^~ | Too variable, discarded |

Advanced Command Examples

#### Detailed Source Analysis

`bash

Comprehensive source information

chronyc sources -v

Source statistics with details

chronyc sourcestats -v

NTP packet information

chronyc ntpdata pool.ntp.org

Authentication status

chronyc authdata `

#### Manual Time Adjustments

`bash

Enable manual mode

chronyc manual on

Set manual offset

chronyc manual reset

Disable manual mode

chronyc manual off

Delete manual samples

chronyc manual delete 0 `

#### Configuration Management

`bash

Reload configuration

sudo systemctl reload chronyd

Add new server temporarily

chronyc add server time.example.com

Remove server

chronyc delete time.example.com

Modify server parameters

chronyc modify time.example.com maxpoll 8 `

Monitoring and Troubleshooting

Log File Analysis

#### Main Log Locations

| Distribution | Log Path | |--------------|----------| | RHEL/CentOS/Fedora | /var/log/chrony/ | | Debian/Ubuntu | /var/log/chrony/ | | SUSE/openSUSE | /var/log/chrony/ | | systemd journal | journalctl -u chronyd |

#### Log File Types

`bash

Measurements log

tail -f /var/log/chrony/measurements.log

Statistics log

tail -f /var/log/chrony/statistics.log

Tracking log

tail -f /var/log/chrony/tracking.log

System journal

journalctl -u chronyd -f `

Common Issues and Solutions

#### Issue: Time Not Synchronizing

`bash

Check service status

sudo systemctl status chronyd

Verify network connectivity

chronyc sources

Check for firewall issues

sudo firewall-cmd --list-all

Review configuration

sudo chrony -Q 'pool pool.ntp.org iburst' `

#### Issue: High Time Offset

`bash

Check current tracking

chronyc tracking

Force step adjustment

sudo chronyc makestep

Verify hardware clock

sudo hwclock --show

Check for VM time drift

dmesg | grep -i time `

#### Issue: Sources Not Reachable

`bash

Test DNS resolution

nslookup pool.ntp.org

Check network routes

traceroute pool.ntp.org

Verify NTP port access

telnet pool.ntp.org 123

Review firewall rules

sudo iptables -L | grep 123 `

Performance Monitoring

#### Key Metrics to Monitor

| Metric | Command | Acceptable Range | |--------|---------|------------------| | Time Offset | chronyc tracking | < 100ms | | Root Delay | chronyc tracking | < 200ms | | Root Dispersion | chronyc tracking | < 100ms | | Frequency Error | chronyc tracking | < 100 ppm | | Source Reachability | chronyc sources | 377 (octal) |

#### Monitoring Scripts

`bash #!/bin/bash

chrony-monitor.sh

Check chrony daemon status

if ! systemctl is-active --quiet chronyd; then echo "ERROR: chronyd is not running" exit 1 fi

Get tracking information

tracking_output=$(chronyc tracking) offset=$(echo "$tracking_output" | grep "System time" | awk '{print $4}') stratum=$(echo "$tracking_output" | grep "Stratum" | awk '{print $3}')

Check offset threshold

if (( $(echo "$offset > 0.1" | bc -l) )); then echo "WARNING: Time offset too high: $offset seconds" fi

Check stratum level

if [ "$stratum" -gt 5 ]; then echo "WARNING: Stratum level too high: $stratum" fi

echo "Chrony status: OK" `

Advanced Configuration

Hardware Timestamping

`bash

Enable hardware timestamping

hwtimestamp eth0

Check interface capabilities

ethtool -T eth0

Configure in chrony.conf

hwtimestamp eth0 rxfilter all `

PTP Integration

`bash

Configure PTP reference

refclock PHC /dev/ptp0 poll 0 dpoll -2 offset 0

PTP-specific options

ptp_port 319 ptp_transport udp `

Leap Second Handling

`bash

Configure leap second file

leapsectz right/UTC

Manual leap second insertion

chronyc add leap +1

Leap second monitoring

chronyc tracking | grep "Leap status" `

Multi-homed Systems

`bash

Bind to specific interface

bindaddress 192.168.1.100 bindaddress 10.0.0.100

Interface-specific servers

server time1.example.com sourcedir 192.168.1.0/24 server time2.example.com sourcedir 10.0.0.0/8 `

Virtual Machine Optimization

`bash

VM-specific configuration

Increase correction thresholds

makestep 1.0 -1

Adjust polling intervals

minpoll 0 maxpoll 4

Enable corrections

corrtimeratio 100 `

Security Considerations

Authentication Configuration

`bash

Generate key file

sudo chrony-keygen

Configure authentication

keyfile /etc/chrony.keys

Server with authentication

server secure.ntp.org key 1

Key file format

/etc/chrony.keys

1 SHA1 HEX:1234567890ABCDEF1234567890ABCDEF12345678 `

Access Control Security

`bash

Restrictive access control

deny all allow 127.0.0.1 allow ::1 allow 192.168.1.0/24

Rate limiting

ratelimit interval 3 burst 8

Command access restriction

bindcmdaddress 127.0.0.1 cmdallow 127.0.0.1 `

Firewall Configuration

`bash

iptables rules

sudo iptables -A INPUT -p udp --dport 123 -j ACCEPT sudo iptables -A OUTPUT -p udp --sport 123 -j ACCEPT

firewalld configuration

sudo firewall-cmd --add-service=ntp --permanent sudo firewall-cmd --reload

ufw configuration

sudo ufw allow ntp `

Performance Optimization

Polling Optimization

| Scenario | minpoll | maxpoll | Rationale | |----------|---------|---------|-----------| | Servers | 4 | 10 | Balanced accuracy/load | | Workstations | 6 | 10 | Reduced network usage | | Virtual Machines | 0 | 4 | Handle time drift | | Mobile Devices | 6 | 12 | Battery conservation |

Memory and CPU Optimization

`bash

Limit memory usage

maxsamples 16 maxdrift 1000

Reduce CPU usage

maxpoll 10 maxdelay 1

Optimize for accuracy

minsamples 6 maxsamples 32 `

Network Optimization

`bash

Reduce network overhead

acquisitionport 0 port 0

Optimize for WAN links

maxdelay 0.3 maxdist 16

Local network optimization

maxdelay 0.01 maxdist 1 `

Best Practices

Configuration Best Practices

1. Use Multiple Sources: Configure at least 3-4 time sources for redundancy 2. Geographic Diversity: Use servers from different geographic locations 3. Stratum Consideration: Prefer lower stratum servers when possible 4. Local Servers: Use local time servers when available

Operational Best Practices

1. Regular Monitoring: Implement automated monitoring of time synchronization 2. Log Analysis: Regularly review chrony logs for issues 3. Update Management: Keep chrony updated to latest stable version 4. Backup Configuration: Maintain backup copies of configuration files

Security Best Practices

1. Access Control: Implement restrictive access control policies 2. Authentication: Use NTP authentication where supported 3. Firewall Rules: Configure appropriate firewall rules 4. Regular Audits: Conduct regular security audits of time infrastructure

Troubleshooting Best Practices

1. Systematic Approach: Follow systematic troubleshooting methodology 2. Documentation: Document configuration changes and issues 3. Testing: Test changes in non-production environments first 4. Rollback Plans: Maintain rollback procedures for configuration changes

This comprehensive guide provides the foundation for implementing and managing chrony time synchronization in various environments. Regular monitoring and maintenance ensure optimal performance and accuracy of time synchronization across your infrastructure.

Tags

  • NTP
  • chrony
  • linux administration
  • network protocols
  • time-synchronization

Related Articles

Popular Technical Articles & Tutorials

Explore our comprehensive collection of technical articles, programming tutorials, and IT guides written by industry experts:

Browse all 8+ technical articles | Read our IT blog

Chrony Time Sync: Complete Guide &amp; Implementation