---
title: "Keep server clocks in sync · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/servers/time-sync
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep server clocks in sync

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Servers](https://agentwranglers.se/playbook/infrastructure/servers.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Recommended
- Chapter: [Servers](https://agentwranglers.se/playbook/infrastructure/servers)
- Rule: Run a time sync client on every server with at least two time sources. Keep every server on UTC, and alert when a clock is more than 1 second off.
- How: Clocks drift. A wrong clock breaks the order of logs across servers, certificate checks, signed tokens and one-time codes. Use the system's client, such as chrony or systemd-timesyncd. Point it at your cloud's time service or a public pool, with two sources at least. Set the time zone to UTC, so logs from different machines line up as [Log structured events](https://agentwranglers.se/playbook/operations/logs/structured-logs) expects.
- Check: On every server, `timedatectl show -p NTPSynchronized --value` prints `yes` and `timedatectl show -p Timezone --value` prints `Etc/UTC` or `UTC`. `chronyc tracking` shows a system time offset under 1 second.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
timedatectl set-timezone Etc/UTC
timedatectl show -p NTPSynchronized --value   # yes
chronyc tracking | grep 'System time'         # System time : 0.000012 seconds fast of NTP time
chronyc sources                               # two or more sources, one marked *
```

### Plain text example

```text
# /etc/chrony/chrony.conf
pool 2.pool.ntp.org iburst maxsources 2
server time.example.com iburst
makestep 1 3
```

## Sources

- [RFC 5905 Network Time Protocol Version 4](https://www.rfc-editor.org/rfc/rfc5905)
- [Ubuntu Server guide to serving NTP with Chrony](https://ubuntu.com/server/docs/how-to/networking/serve-ntp-with-chrony/)

## Related rules

- [Log structured events](https://agentwranglers.se/playbook/operations/logs/structured-logs) in Operations

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/servers/time-sync">Agent Wranglers infrastructure playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Allow SSH with keys only](https://agentwranglers.se/playbook/infrastructure/servers/ssh-keys-only)
- Next: [Remove services the server does not need](https://agentwranglers.se/playbook/infrastructure/servers/minimal-services)
- [Servers](https://agentwranglers.se/playbook/infrastructure/servers)