LFCE 71 🐧 chrony — Configuration - KandZ

⏱️ Estimated read: 12 min | |

chrony is the default NTP implementation on RHEL, Rocky Linux, and their derivatives, and it is available on Debian and Ubuntu as an alternative to ntpd. The previous chapter explained why time synchronization matters; this chapter covers the configuration file that makes it work. The configuration lives in /etc/chrony.conf on RHEL-like systems and /etc/chrony/chrony.conf on Debian-like systems, and the daemon is chronyd . The file is a list of directives, each on its own line, with the server and pool directives defining the time sources and the driftfile, makestep, and rtcsync directives defining how the daemon disciplines the clock.

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The configuration is not complex, but the default file contains commented examples that are easy to mistake for active settings. The active directives are the ones without a leading #. The chronyd -Q command validates the configuration by querying the time sources without modifying the system clock, and the chronyc tracking and chronyc sources -v commands show the synchronization status and the list of sources after the daemon is running .

Key point: The server directive defines a single NTP server, and the pool directive defines a DNS name that resolves to multiple servers. The iburst option sends a burst of packets at startup to speed up the initial synchronization. The driftfile records the clock’s frequency offset so that the daemon can correct it quickly after a restart. The makestep directive allows the daemon to step the clock (rather than slewing it slowly) when the offset exceeds a threshold, but only during the first few updates after startup. The rtcsync directive keeps the hardware clock synchronized with the system clock .

Why chrony configuration requires explicit directives

The default-file problem.

The default chrony.conf on RHEL and Rocky Linux contains a pool directive for the distribution’s NTP pool and several commented directives for allow, local, and log . The file works without modification on a system with internet access, but a server behind a firewall or in an isolated network needs the pool directive replaced with internal servers, and the firewall opened for UDP 123. The commented directives are documentation, not active configuration, and the administrator must decide which ones to enable.

The step-versus-slew problem.

chrony adjusts the clock in two ways. A slew is a gradual adjustment that speeds up or slows down the clock until it matches the reference. A step is an immediate jump to the correct time. A step can confuse applications that are running, because timers and timestamps jump abruptly. The makestep directive allows a step only when the offset exceeds a threshold, and only during the first few updates after startup, when the system is still booting and no applications are running . After that window, the daemon uses slewing, which is safer for running applications.

The drift-file problem.

The system clock’s frequency is not exactly 1 Hz; it runs slightly fast or slow, and the rate varies with temperature and hardware. chrony measures the rate and stores it in the driftfile. On the next startup, the daemon reads the file and applies the correction immediately, which reduces the time needed to reach synchronization. The driftfile must be writable by the chrony user, and the directory must exist .

a. The server, pool, and source directives

The server directive defines a single NTP server, and the pool directive defines a DNS name that resolves to multiple servers. The iburst option sends a burst of packets at startup, which speeds up the initial synchronization.

# /etc/chrony.conf
# Use a pool of public servers
pool 2.pool.ntp.org iburst

# Or use specific internal servers
server ntp1.example.com iburst
server ntp2.example.com iburst

The pool directive is the recommended form for public NTP, because the DNS name resolves to multiple servers and chrony selects the best ones. The server directive is used when the server addresses are known and stable . The iburst option is recommended for both forms, because it sends four packets in quick succession when the daemon starts, which allows it to reach synchronization faster than the normal polling interval would allow.

The maxsources option on the pool directive limits the number of servers that chrony uses from the pool. The default is 4, and the maximum is 16 .

pool pool.ntp.org iburst maxsources 3

The prefer option marks a source as preferred over other selectable sources, and the noselect option marks a source as never selected. These are useful when a server should be used only as a backup or when a specific source is known to be more accurate .

b. The driftfile, makestep, and rtcsync directives

The driftfile records the clock’s frequency offset, the makestep directive controls when the clock can be stepped, and the rtcsync directive keeps the hardware clock synchronized.

# Record the clock rate
driftfile /var/lib/chrony/drift

# Step the clock if the offset exceeds 1 second,
# but only during the first 3 updates after startup
makestep 1.0 3

# Synchronize the hardware clock with the system clock
rtcsync

The driftfile path is /var/lib/chrony/drift on RHEL and /var/lib/chrony/chrony.drift on some Debian systems. The file is written by the daemon and read at startup. The makestep 1.0 3 directive tells chrony to step the clock if the offset is greater than 1 second, but only for the first three updates. After the third update, the daemon slews the clock instead . The rtcsync directive enables kernel synchronization of the real-time clock every 11 minutes, which keeps the hardware clock close to the system clock .

The maxupdateskew directive sets a limit on the frequency skew that the daemon will accept. A value of 100 (ppm) means that updates with a skew greater than 100 ppm are ignored, which prevents the daemon from learning a bad frequency correction from a noisy measurement .

maxupdateskew 100

c. The allow, local, and log directives

The allow directive permits clients on a network to use the server as a time source. The local directive configures the server to serve time even when it is not synchronized to an external source. The log directives control the daemon’s logging.

# Allow clients on the local network to query this server
allow 192.168.1.0/24

# Serve time even if not synchronized, with stratum 10
local stratum 10

# Log directory
logdir /var/log/chrony

The allow directive is used when the server is also a time source for other machines. Without it, the server responds to queries but does not serve time . The local stratum 10 directive allows the server to appear synchronized even when it has no external source, which is useful in an isolated network where no external NTP server is reachable. The stratum 10 value is a convention for a local fallback source, and it should be higher than the stratum of any real source .

The logdir directive sets the directory for the log files, and the log directives select which information is logged. The log tracking directive logs the tracking information, and the log measurements directive logs the raw measurements .

logdir /var/log/chrony
log tracking measurements statistics

Complete Example Session

# ============================================
# PART 1: BACK UP THE DEFAULT CONFIGURATION
# ============================================
sudo cp /etc/chrony.conf /etc/chrony.conf.bak

# ============================================
# PART 2: EDIT THE CONFIGURATION
# ============================================
sudo tee /etc/chrony.conf > /dev/null <<'EOF'
# Use public NTP pool servers
pool 2.pool.ntp.org iburst

# Record the clock rate
driftfile /var/lib/chrony/drift

# Step the clock during the first 3 updates if the offset exceeds 1 second
makestep 1.0 3

# Synchronize the hardware clock
rtcsync

# Allow clients on the local network
allow 192.168.1.0/24

# Serve time even if not synchronized
local stratum 10

# Log directory
logdir /var/log/chrony
log tracking measurements statistics
EOF

# ============================================
# PART 3: VALIDATE THE CONFIGURATION
# ============================================
sudo chronyd -Q -f /etc/chrony.conf
# Output shows the time offset and confirms the config is valid

# ============================================
# PART 4: RESTART AND ENABLE THE SERVICE
# ============================================
sudo systemctl restart chronyd
sudo systemctl enable chronyd
sudo systemctl status chronyd
# Output: active (running)

# ============================================
# PART 5: CHECK THE TRACKING STATUS
# ============================================
chronyc tracking
# Output shows the reference ID, stratum, system time offset, and frequency

# ============================================
# PART 6: LIST THE SOURCES
# ============================================
chronyc sources -v
# Output shows the servers with a * next to the selected source

# ============================================
# PART 7: CHECK THE SOURCE STATISTICS
# ============================================
chronyc sourcestats -v
# Output shows the drift and offset estimates for each source

# ============================================
# PART 8: FORCE A STEP CORRECTION
# ============================================
sudo chronyc makestep
# Steps the clock immediately

# ============================================
# PART 9: OPEN THE FIREWALL
# ============================================
sudo firewall-cmd --permanent --add-service=ntp
sudo firewall-cmd --reload

# ============================================
# PART 10: VERIFY THE SERVICE IS LISTENING
# ============================================
sudo ss -ulnp | grep :123
# Output: UNCONN 0 0 *:123 *:* users:(("chronyd",...))

The ten parts demonstrate the complete chrony configuration: backup, editing, validation, restart, tracking, source listing, source statistics, step correction, firewall, and port verification. The critical step is Part 3: chronyd -Q validates the configuration by querying the sources without modifying the clock, which catches syntax errors and unreachable sources before the service is restarted.

Quick Reference

Core Directives

Directive	Purpose	Example
`pool`	DNS name with multiple servers	`pool 2.pool.ntp.org iburst`
`server`	Single NTP server	`server ntp1.example.com iburst`
`driftfile`	Clock rate record	`/var/lib/chrony/drift`
`makestep`	Step threshold and limit	`makestep 1.0 3`
`rtcsync`	Sync hardware clock	`rtcsync`
`maxupdateskew`	Limit frequency skew	`maxupdateskew 100`
`allow`	Permit client network	`allow 192.168.1.0/24`
`local`	Serve time without sync	`local stratum 10`

Server Options

Option	Purpose
`iburst`	Send burst at startup
`prefer`	Prefer this source
`noselect`	Never select this source
`maxsources N`	Pool sources to use (default 4)
`minpoll N` / `maxpoll N`	Polling interval range

Commands

Command	Purpose
`chronyd -Q -f <config>`	Validate configuration
`systemctl restart chronyd`	Apply configuration
`chronyc tracking`	Show sync status
`chronyc sources -v`	List sources
`chronyc sourcestats -v`	Show source statistics
`chronyc makestep`	Force immediate step

Config File Locations

Distribution	Path
RHEL / Rocky / Fedora	`/etc/chrony.conf`
Debian / Ubuntu	`/etc/chrony/chrony.conf`

Best Practices

✅ Do This:

# Use a pool for public servers
pool 2.pool.ntp.org iburst                                    # ✅

# Set a drift file
driftfile /var/lib/chrony/drift                               # ✅

# Allow stepping only during the first updates
makestep 1.0 3                                                # ✅

# Enable RTC synchronization
rtcsync                                                       # ✅

# Allow clients on the local network
allow 192.168.1.0/24                                          # ✅

# Validate before restarting
chronyd -Q -f /etc/chrony.conf                                # ✅

❌ Don’t Do This:

# Run chronyd and ntpd at the same time
# They conflict and both try to discipline the clock         # ❌

# Use makestep without a limit
makestep 1.0 -1    # Steps on every update, even after boot  # ❌

# Forget to open UDP 123
# Clients cannot reach the server                             # ❌

# Set local stratum without understanding the fallback
# The server may appear synchronized when it is not           # ❌

# Edit the wrong config file
# Check the daemon's -f flag for the path                     # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
chronyd and ntpd conflict	Both installed and running	Disable one; use chrony
Config not applied	Wrong file path	Check `ps -ef \| grep chronyd` for `-f`
Clients cannot sync	Firewall blocks UDP 123	Open the NTP service
Large offset not corrected	`makestep` limit reached	`chronyc makestep` manually
Service fails to start	Syntax error	`chronyd -Q` reports the error

Real-World Examples

1. Public pool

pool 2.pool.ntp.org iburst

2. Internal servers

server ntp1.example.com iburst
server ntp2.example.com iburst

3. Drift file

driftfile /var/lib/chrony/drift

4. Makestep

makestep 1.0 3

5. RTC sync

rtcsync

6. Allow local network

allow 192.168.1.0/24

7. Local fallback

local stratum 10

8. Validate config

chronyd -Q -f /etc/chrony.conf

9. Check tracking

chronyc tracking

10. List sources

chronyc sources -v

Visual

chrony.conf Structure

┌──────────────────────────────────────────────────────────────┐
│  THE CONFIGURATION IS A LIST OF DIRECTIVES                   │
│                                                              │
│  pool 2.pool.ntp.org iburst    ← Time sources               │
│                                                              │
│  driftfile /var/lib/chrony/drift ← Clock rate record        │
│                                                              │
│  makestep 1.0 3                ← Step policy                │
│                                                              │
│  rtcsync                       ← Hardware clock sync        │
│                                                              │
│  allow 192.168.1.0/24          ← Client access              │
│                                                              │
│  local stratum 10              ← Fallback source            │
└──────────────────────────────────────────────────────────────┘

Server Selection

┌──────────────────────────────────────────────────────────────┐
│  chronyc sources -v SHOWS THE SOURCE STATE                   │
│                                                              │
│  MS Name/IP address    Stratum Poll Reach LastRx Last sample │
│  ============================================================│
│  ^* ntp1.example.com      2    6   377    42  +15us[+20us]  │
│  ^+ ntp2.example.com      2    6   377    44  +18us[+23us]  │
│  ^? ntp3.example.com      0    6     0     -  unreachable   │
│                                                              │
│  ^* = selected for synchronization                           │
│  ^+ = included in the combined estimate                      │
│  ^? = unreachable or not yet sampled                         │
└──────────────────────────────────────────────────────────────┘

Validation Flow

┌──────────────────────────────────────────────────────────────┐
│  VALIDATE BEFORE RESTARTING                                  │
│                                                              │
│  Edit chrony.conf                                            │
│       │                                                      │
│       ▼                                                      │
│  chronyd -Q -f /etc/chrony.conf                              │
│       │                                                      │
│       ├── Error → Fix file, repeat                           │
│       │                                                      │
│       └── Success → systemctl restart chronyd                │
│                           │                                  │
│                           ▼                                  │
│                     chronyc tracking                         │
│                     (confirm sync)                           │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
RHEL config	`/etc/chrony.conf`
Debian config	`/etc/chrony/chrony.conf`
Daemon	`chronyd`
Service	`chronyd` or `chrony`
Time source (single)	`server <host> iburst`
Time source (pool)	`pool <name> iburst`
Clock rate record	`driftfile`
Step policy	`makestep <threshold> <limit>`
Hardware clock	`rtcsync`
Client access	`allow <network>`
Fallback	`local stratum <n>`
Validation	`chronyd -Q -f <config>`
Tracking	`chronyc tracking`
Sources	`chronyc sources -v`

Key takeaways:

The server and pool directives define the time sources. The pool form resolves a DNS name to multiple servers and is the recommended choice for public NTP. The iburst option speeds up the initial synchronization by sending a burst of packets at startup .
The driftfile records the clock’s frequency offset. The daemon reads it at startup and applies the correction immediately, which reduces the time needed to reach synchronization. The file must be writable by the chrony user.
The makestep directive limits when the clock can be stepped. A step is an immediate jump that can confuse running applications. The directive allows a step only during the first few updates after startup, when the offset exceeds a threshold. After that, the daemon slews the clock .
The allow directive permits clients to use the server as a time source. Without it, the server responds to queries but does not serve time. The local stratum directive allows the server to serve time even when it is not synchronized to an external source .
chronyd -Q validates the configuration without modifying the clock. It queries the time sources and reports the offset, which confirms that the configuration is syntactically valid and the sources are reachable. It should be run before restarting the service .
chronyc tracking and chronyc sources -v show the synchronization status. The tracking output shows the reference ID, stratum, and offset. The sources output shows each server with a * next to the selected source and a + next to the sources included in the combined estimate .

Remember: chrony is configured in a single file with a list of directives. The pool or server directives define the time sources. The driftfile records the clock rate. The makestep directive controls when the clock can be stepped. The rtcsync directive keeps the hardware clock synchronized. The allow directive permits clients to use the server as a time source. Validate with chronyd -Q, restart with systemctl restart chronyd, and verify with chronyc tracking and chronyc sources -v. The configuration is simple, but the makestep and allow directives are the ones that determine whether the daemon behaves correctly after a reboot and whether other machines can rely on it.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!