Test and diagnostics

Verification and troubleshooting

Before you change anything, check that you can reach the server and that the offset looks sane. Expected values and fixes for common problems are below.

How to test

without touching the system clock

A single measurement that does not touch the system clock

chronyd -Q 'server ntp.alastyr.com iburst'
chronyd -Q 'server ntp.alastyr.com iburst nts'    # with NTS
ntpdate -q ntp.alastyr.com
sntp -d ntp.alastyr.com

Measuring on Windows

w32tm /stripchart /computer:ntp.alastyr.com /samples:5 /dataonly
w32tm /query /status /verbose

Continuous monitoring

watch -n 2 chronyc -N sources -v      # live source state
chronyc -N sourcestats                # per-source stability and skew
chronyc -N ntpdata ntp.alastyr.com    # packet-level detail
chronyc tracking                      # summary of the system clock

What to expect

Offset: typically under 50 ms across the public internet
Jitter: under 5 ms on a stable link
Stratum: 2
Reach: 377 — all eight of the last eight polls were answered
Leap status: Normal
Source marker: ^* system reference · ^+ included in the combination

If the offset comes out in the hundreds of milliseconds, the problem is usually not the server but the path: asymmetric routing, a saturated link, or buffering in a NAT or firewall. Measure several independent sources at the same time and compare — if all of them drift together, the fault is on the path, not at either end.

Troubleshooting

The symptoms we see most often, what actually causes them, and how to fix them.

Symptom	Cause	Fix
reach 0	Outbound UDP 123 is blocked, or replies are not coming back	Allow outbound UDP 123 and its return traffic in the firewall. NTP is frequently blocked on corporate networks.
The clock keeps jumping back and forth	On a virtual machine, both the hypervisor and the guest are setting the clock	Disable VMware Tools / Hyper-V time synchronisation. A guest must have exactly one time source.
Synchronisation never completes	Two NTP clients are running at once	`chronyd` and `systemd-timesyncd` cannot coexist. Stop and disable one of them.
adjtimex / clock_settime permission error	Something inside a container is trying to set the clock	Do not run NTP in a container. Synchronise the host; the container inherits its clock.
w32tm times out	The name does not resolve, or UDP 123 is closed	Check the name with `nslookup ntp.alastyr.com`, then reachability with `w32tm /stripchart`.
The clock is right but logs show a different time	The system keeps UTC and no time zone is configured	`timedatectl set-timezone Europe/Istanbul`. Keeping servers on UTC is also a perfectly valid choice.
The clock corrects itself very slowly	This is deliberate — a large offset is slewed, not stepped	Expected behaviour. If you really need it, allow stepping for the first few corrections with `makestep`.
A one-hour shift twice a year	Stale `tzdata` still trying to apply daylight saving	Update the `tzdata` package. Türkiye has used UTC+03:00 all year round since 2016.
The NTS handshake fails	Connecting by IP address, or TCP 4460 is blocked	Use the hostname (the certificate is issued for the name) and allow outbound TCP 4460.
NTS works but the NAK count keeps rising	`ntsdumpdir` is not set, so cookies are lost on restart	Add `ntsdumpdir /var/lib/chrony` to the client configuration.