Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 2. Using chrony

Learn how to start and stop chronyd, check it is synchronized, and manually adjust the system clock.

2.1. Managing chrony
Link kopieren

You can start, stop, and check the status of chronyd.

  1. The chrony suite is installed by default on Red Hat Enterprise Linux. To ensure that it is, run the following command as root: 

    # dnf install chrony
    Copy to Clipboard Toggle word wrap

    The default location for the chrony daemon is /usr/sbin/chronyd. The command line utility will be installed to /usr/bin/chronyc.

  2. To check the status of chronyd, issue the following command: 

    $  systemctl status chronyd
chronyd.service - NTP client/server
   Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled)
   Active: active (running) since Wed 2013-06-12 22:23:16 CEST; 11h ago
    Copy to Clipboard Toggle word wrap

  3. To start chronyd, issue the following command as root: 

    # systemctl start chronyd
    Copy to Clipboard Toggle word wrap

    To ensure chronyd starts automatically at system start, issue the following command as root: 

    # systemctl enable chronyd
    Copy to Clipboard Toggle word wrap

  4. To stop chronyd, issue the following command as root: 

    # systemctl stop chronyd
    Copy to Clipboard Toggle word wrap

    To prevent chronyd from starting automatically at system start, issue the following command as root: 

    # systemctl disable chronyd
    Copy to Clipboard Toggle word wrap

2.2. Manually adjusting the system clock
Link kopieren

You can manually adjust the system clock.

Procedure

  • To step the system clock immediately, by passing any adjustments in progress by slewing, enter: 

    # chronyc makestep
    Copy to Clipboard Toggle word wrap
Important

If the rtcfile directive is used, the real-time clock should not be manually adjusted. Random adjustments would interfere with chrony's need to measure the rate at which the real-time clock drifts.

2.3. Disabling a NetworkManager dispatcher script
Link kopieren

The chrony dispatcher script manages the online and offline state of the NTP servers. As a system administrator, you can disable the dispatcher script to keep chronyd polling the servers constantly.

The NetworkManager executes the chrony dispatcher script during interface reconfiguration, stop or start operations. However, if you configure certain interfaces or routes outside of NetworkManager, you can encounter the following situation:

  1. The dispatcher script might run when no route to the NTP servers exists, causing the NTP servers to switch to the offline state.
  2. If you establish the route later, the script does not run again by default, and the NTP servers remain in the offline state.

To ensure that chronyd can synchronize with your NTP servers, which have separately managed interfaces, disable the dispatcher script.

Procedure

  • To disable the chrony dispatcher script, create a symlink to /dev/null: 

    # ln -f -s /dev/null /etc/NetworkManager/dispatcher.d/20-chrony-onoffline
    Copy to Clipboard Toggle word wrap
    Note

    After this change, the NTP servers remain in the online state at all times.

2.4. Setting up chrony in an isolated network
Link kopieren

For a network that is never connected to the internet, one computer is selected to be the primary timeserver. The other computers are either direct clients of the server, or clients of clients. On the server, the drift file must be manually set with the average rate of drift of the system clock. If the server is rebooted, it will obtain the time from surrounding systems and calculate an average to set its system clock. Thereafter it resumes applying adjustments based on the drift file. The drift file will be updated automatically when the settime command is used.

To set up chrony for a system in an isolated network, follow the steps mentioned below:

Procedure

  1. On the system selected to be the server, edit /etc/chrony.conf as follows: 

    driftfile /var/lib/chrony/drift
commandkey 1
keyfile /etc/chrony.keys
initstepslew 10 client1 client3 client6
local stratum 8
manual
allow <subnet>
    Copy to Clipboard Toggle word wrap

    Where <subnet> is the network from which the clients are allowed to connect. Use Classless Inter-Domain Routing (CIDR) notation to specify the subnet.

  2. On the systems selected to be direct clients of the server, edit the /etc/chrony.conf as follows: 

    server <server_fqdn>
driftfile /var/lib/chrony/drift
logdir /var/log/chrony
log measurements statistics tracking
keyfile /etc/chrony.keys
commandkey 24
local stratum 10
initstepslew 20 ntp1.example.net
allow <server_ip_address>
    Copy to Clipboard Toggle word wrap

    Where <server_fqdn> is the host name of the server, and <server_ip_address> is the address of the server . Clients with this configuration will resynchronize with the server if it restarts.

On the client systems which are not to be direct clients of the server, the /etc/chrony.conf file should be the same except that the local and allow directives should be omitted.

In an isolated network, you can also use the local directive that enables a local reference mode, which allows chronyd operating as an NTP server to appear synchronized to real time, even when it was never synchronized or the last update of the clock happened a long time ago.

To allow multiple servers in the network to use the same local configuration and to be synchronized to one another without confusing clients that poll more than one server, use the orphan option of the local directive which enables the orphan mode. Each server needs to be configured to poll all other servers with local. This ensures that only the server with the smallest reference ID has the local reference active and other servers are synchronized to it. When the server fails, another one takes over.

2.5. Configuring remote monitoring access
Link kopieren

The chronyc utility can access chronyd by using the following methods:

  • IPv4 or IPv6.
  • A domain socket, which is accessible locally by the root and chrony user.

By default, chronyc connects to the Unix domain socket. The default path is /var/run/chrony/chronyd.sock. If this connection fails, chronyc tries to connect to 127.0.0.1 and then ::1.

Only the following monitoring commands, which do not affect the behavior of chronyd, are allowed from the network:

  • activity
  • manual list
  • rtcdata
  • smoothing
  • sources
  • sourcestats
  • tracking
  • waitsync

By default, the commands are accepted only from localhost (127.0.0.1 or ::1).

All other commands are allowed only through the Unix domain socket. When sent over the network, chronyd responds with a Not authorised error, even if it is from localhost.

The following procedure describes how to access chronyd remotely with chronyc.

Procedure

  1. Configure chrony to listen on local interface by adding the following to the /etc/chrony.conf file: 

    bindcmdaddress 0.0.0.0
    Copy to Clipboard Toggle word wrap

    and 

    bindcmdaddress ::
    Copy to Clipboard Toggle word wrap

  2. Allow commands from remote IP addresses, networks, and subnet:

    Add the following content to the /etc/chrony.conf file: 

    cmdallow 192.168.1.0/24
    Copy to Clipboard Toggle word wrap 
    cmdallow 2001:db8::/64
    Copy to Clipboard Toggle word wrap

  3. Open port 323 in the firewall to allow connections from remote systems: 

    # firewall-cmd --permanent --add-port=323/udp
    Copy to Clipboard Toggle word wrap

  4. Reload the firewall configuration: 

    # firewall-cmd --reload
    Copy to Clipboard Toggle word wrap

2.6. Checking if chrony is synchronized
Link kopieren

You can check if chrony is synchronized with the use of the tracking, sources, and sourcestats commands.

Procedure

  1. To check chrony tracking, enter: 

    $  chronyc tracking
Reference ID    : CB00710F (ntp-server.example.net)
Stratum         : 3
Ref time (UTC)  : Fri Jan 27 09:49:17 2017
System time     :  0.000006523 seconds slow of NTP time
Last offset     : -0.000006747 seconds
RMS offset      : 0.000035822 seconds
Frequency       : 3.225 ppm slow
Residual freq   : 0.000 ppm
Skew            : 0.129 ppm
Root delay      : 0.013639022 seconds
Root dispersion : 0.001100737 seconds
Update interval : 64.2 seconds
Leap status     : Normal
    Copy to Clipboard Toggle word wrap

  2. The chronyc sources command displays information about the current time sources that chronyd is accessing. 

    $ chronyc sources
	210 Number of sources = 3
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
#* GPS0                          0   4   377    11   -479ns[ -621ns] /-  134ns
^? a.b.c                         2   6   377    23   -923us[ -924us] +/-   43ms
^ d.e.f                         1   6   377    21  -2629us[-2619us] +/-   86ms
    Copy to Clipboard Toggle word wrap

    You can specify the optional -v argument to print more verbose information. In this case, extra caption lines are shown as a reminder of the meanings of the columns.

  3. The sourcestats command displays information about the drift rate and offset estimation process for each of the sources currently being examined by chronyd. To check chrony source statistics, issue the following command: 

    $  chronyc sourcestats
210 Number of sources = 1
Name/IP Address            NP  NR  Span  Frequency  Freq Skew  Offset  Std Dev
===============================================================================
abc.def.ghi                11   5   46m     -0.001      0.045      1us    25us
    Copy to Clipboard Toggle word wrap

    The optional argument -v can be specified, meaning verbose. In this case, extra caption lines are shown as a reminder of the meanings of the columns.

Nach oben
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2025 Red Hat