Linux Time Synchronization with NTP and Chrony

Time synchronization in Linux ensures that system clocks remain accurate and uniform across distributed environments, which is critical for log integrity, database transactions, and cryptographic authentication. This article explores how Linux manages time between hardware and the kernel, how the Network Time Protocol (NTP) algorithm measures and corrects time discrepancies, and how modern implementations like Chrony and the legacy ntpd daemon actively maintain synchronization.

System Clock vs. Hardware Clock

Linux distinguishes between two primary clocks:

• The Hardware Clock (Real-Time Clock / RTC): A battery-backed chip on the motherboard that tracks time even when the system is powered off.
• The System Clock (Kernel Clock): A software-driven clock maintained by the operating system kernel once booted, derived from CPU timer interrupts.

At boot, the kernel reads the RTC to initialize the system clock. Once the OS is running, the system clock takes over. Because physical quartz crystals on motherboards are vulnerable to temperature fluctuations and hardware imperfections, the system clock inevitably drifts from real-world time. Time synchronization software corrects this drift.

The Network Time Protocol (NTP) Mechanism

Linux uses the Network Time Protocol (NTP) to exchange timing information over UDP port 123. NTP organizes time sources into a hierarchical system known as "strata":

• Stratum 0: High-precision atomic clocks, GPS receivers, or radio clocks.
• Stratum 1: Servers directly connected to Stratum 0 devices.
• Stratum 2: Servers that synchronize with Stratum 1 servers across a network, serving as relays for clients and lower strata.

To determine the accurate time, an NTP client periodically exchanges timestamped packets with one or more reference servers. Each exchange records four timestamps:

1. When the client sends the request (\(T_1\)).
2. When the server receives the request (\(T_2\)).
3. When the server sends the response (\(T_3\)).
4. When the client receives the response (\(T_4\)).

Using these values, the client calculates two essential metrics:

• Round-Trip Delay: \(\text{Delay} = (T_4 - T_1) - (T_3 - T_2)\)
• Clock Offset: \(\text{Offset} = \frac{(T_2 - T_1) + (T_3 - T_4)}{2}\)

By querying multiple servers, the client filters out network jitter and rejects unreliable servers ("falsetickers") to compute a statistically robust time offset.

Correcting the Clock: Slewing vs. Stepping

When a discrepancy is detected, the Linux kernel corrects the system clock using one of two methods:

• Stepping: Instantly jumping the clock forward or backward to the correct time. While necessary during initial boot or when drift is massive, backward steps can cause serious issues with logs, databases, and scheduled cron jobs.
• Slewing: Gradually accelerating or decelerating the rate at which the kernel updates system time until it aligns with real time. In Linux, this is achieved through system calls such as adjtimex(), altering the clock frequency smoothly without creating duplicate timestamps or moving backward.

Chrony vs. NTPd

Linux systems primarily use either the traditional ntpd daemon or the modern chronyd (Chrony) service to automate this process.

Chrony (chronyd)

Chrony is the default time synchronization utility in modern distributions like RHEL, CentOS, Rocky Linux, Fedora, and Debian/Ubuntu variants. Chrony was designed to address the realities of modern compute environments:

• Fast Synchronization: It calculates clock drift significantly faster than ntpd, stabilizing the clock in minutes rather than hours.
• Intermittent Connectivity: It handles network drops, fluctuating latency, and mobile connections gracefully.
• Virtualization Support: Chrony performs well in virtual machines and containers where system clocks frequently stall or desynchronize when the host is under load.
• Management: Administrators control and query Chrony using the chronyc command-line utility (e.g., chronyc sources -v and chronyc tracking).

The NTP Daemon (ntpd)

The reference implementation of the Network Time Protocol, ntpd, is an older, battle-tested service. It is designed for permanently connected physical servers that require microsecond precision over long periods of stable operation. It prioritizes stability over rapid adjustment, exclusively slewing the clock under normal operations once the initial offset is resolved. Its state is queried using ntpq (e.g., ntpq -p).

Synchronization with the Hardware Clock

To ensure the hardware clock stays accurate while the machine is running, the Linux kernel utilizes "11-minute mode." Whenever the system clock is synchronized by an NTP or Chrony daemon, the kernel automatically writes the accurate system time back to the RTC every 11 minutes. This ensures that subsequent reboots start with an accurate baseline time before network services become available.