Quick answer
The server most often lags in time due to an unavailable NTP server, blocked UDP port 123, or an incorrect time zone. Check whether the NTP service is active, whether synchronization succeeds, and whether the time difference is too large for automatic adjustment. If the offset is large, first manually set an approximate time, then let NTP finish the job.
How to recognize the problem
- The server clock is slow or ahead of the actual time by several minutes
- Logs show events with incorrect timestamps
- SSL/TLS errors such as certificate is not yet valid or has expired
- Failed domain login or authentication errors
- Cron jobs run at unexpected times
Most common causes
NTP service is not active
The server has chrony, ntpd, or systemd-timesyncd disabled or stopped, so the clock relies only on the local hardware clock, which drifts over time.
NTP traffic is blocked
The firewall or the network the server is on blocks UDP port 123, so the server cannot obtain accurate time from any source.
Incorrect time zone
The time zone is set incorrectly, so the displayed time is off by an hour or two even though the clock itself is accurate.
Offset too large
If the clock drifts beyond the allowed threshold, NTP will not step it abruptly but will gradually correct it or refuse synchronization.
Virtual machine without host synchronization
A VM inherits incorrect time from the host or loses synchronization after migration and pausing, causing the clock to drift.
Step-by-step fix
- 1
Check the current time and synchronization status
Run
timedatectland look at the fields for local time, time zone, and NTP synchronization status. If it says NTP is active but synchronization is not, the problem is in the connection to the NTP source, not in the clock itself. - 2
Check which time service is in use
On most distributions, either
chronyorsystemd-timesyncdis running. Check the status withsystemctl status chronyorsystemctl status chronyd(the name depends on the distribution) orsystemctl status systemd-timesyncd. Do not enable both services at the same time, as they interfere with each other. - 3
Check NTP sources
For chrony, run
chronyc sources -vandchronyc tracking. The column with the^*marker shows the source the server is synchronized with. If there is no asterisk, the server is not getting time from any source. - 4
Check NTP server availability and port 123
Run
chronyc sourcestatsto see sampling statistics per source. Check that the firewall is not blocking outgoing UDP port 123 with rules infirewall-cmdorufw(for examplefirewall-cmd --list-allorufw status verbose). If outbound traffic is restricted, use an NTP server that is allowed on your network. - 5
Set the time zone
If the time is accurate but shifted by a whole hour, the zone is wrong. Set it with
timedatectl set-timezone Europe/Belgradeand check whether the displayed time matches the expected time. - 6
Manually approximate the time if the offset is large
If the clock is behind by several minutes or hours, NTP may refuse it. Stop the active time service (
systemctl stop chronydorsystemctl stop chronyorsystemctl stop systemd-timesyncd), set an approximate time withdate -s "2026-11-10 12:00:00", then restart the service. Do this only if you are sure of the correct time, as it affects all records and tasks. - 7
Force synchronization and check the result
For chrony, run
chronyc makestepto adjust the clock immediately, then runchronyc trackingandtimedatectlagain. The offset value should be in milliseconds and decreasing. - 8
Check that synchronization is maintained
Wait a few minutes and run
timedatectlagain. If the clock drifts again, check whether the service is enabled withsystemctl is-enabled chronydorsystemctl is-enabled chrony(the name depends on the distribution) and, if not, enable it withsystemctl enable chronydorsystemctl enable chrony. Also check whether something else is resetting it, such as host synchronization on a virtual machine.
If nothing helps: deeper checks and virtualization
If the clock still drifts even though NTP is active, check the system logs (journalctl -u chronyd or journalctl -u chrony) and whether errors appear when communicating with sources. For virtual machines, check the host time synchronization settings and disable it if it conflicts with the NTP service inside the guest. On physical servers, check the motherboard battery and the hardware clock status, as a worn battery causes large deviations after a restart. If the server uses a domain, check whether it is a domain member and whether it receives time from a domain controller. For multi-server environments, it is best to have one server act as an internal NTP source and the others synchronize with it.
How to prevent it
- Keep the NTP service enabled and check synchronization status regularly
- Allow UDP port 123 to trusted NTP sources in firewall rules
- Set the correct time zone immediately during server installation
- Monitor clock offset and alert if it exceeds a few seconds
When to call a professional
If the clock still drifts after checking the NTP service, firewall, and time zone, or if the server is part of a domain with multiple controllers, it is better to call IT support to check synchronization across the entire network.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
How much clock offset is acceptable on a server?
For most servers, an offset of a few tens of milliseconds is normal and harmless. An offset greater than one second can cause authentication and log problems, and more than a few minutes almost always causes application errors.
Why is my clock slow even though NTP is enabled?
Most often because the server cannot get a response from the NTP source due to a firewall or unavailable network. Check `chronyc sources -v` and the service status, because an enabled service does not mean synchronization actually succeeds.
Am I allowed to manually change the time on the server?
You can, but only if the offset is large and you are sure of the correct time. Manual changes affect logs, cron jobs, and sessions, so it is better to first stop the NTP service, set an approximate time, and then restart it.