Proxmox VE time issue

[Jackmynet]

Hi all,

I have a weird and frustrating issue with the time on my proxmox VE.

This virtual environment sits on an off site server and is used for backups etc. It runs a few VM's such as a windows sftp server, proxmox backup server and some firewalls. All of the VM's sitting on this VE have correct time but not the VE itself.

The time is for some reason out by 3 minutes preventing my TFA from working. I have read every thread I can find on this and cannot seem to resolve it.

Hoping someone might have ran into the same issue

Any ideas?

See attached picture of the time.

 

[UdoB]

Any ideas?

Did you read https://pve.proxmox.com/pve-docs/pve-admin-guide.html#_time_synchronization ?

If chrony is running, ask it what it sees:

~# chronyc sources
MS Name/IP address         Stratum Poll Reach LastRx Last sample              
===============================================================================
^? static.88-198-53-80.clie>     0  10     0     -     +0ns[   +0ns] +/-    0ns
^? s5.vonderste.in               0  10     0     -     +0ns[   +0ns] +/-    0ns
^? static.179.181.75.5.clie>     0  10     0     -     +0ns[   +0ns] +/-    0ns
^? www.kashra.com                0  10     0     -     +0ns[   +0ns] +/-    0ns
...

Read man chronyc for other commands

 

[Jackmynet]

It shows me servers it is obviously syncing itself with. But why it is achieving a time that is slightly off it doesn't tell me anything about.

If it was off by an hour or a few hours it would be easier to troubleshoot due to ntp or time zones but a few minutes makes no sense to me.

 

[Kingneutron]

https://github.com/kneutron/ansitest/blob/master/timesync

If that doesn't work / time skews again after 24H, try replacing the CMOS battery

 

[BobhWasatch]

It shows me servers it is obviously syncing itself with. But why it is achieving a time that is slightly off it doesn't tell me anything about.

It is "obviously" not syncing or the time would be correct. What is the actual output of "chronyc sources"?

 

[Jackmynet]

It is syncing to some degree because if I change time zone it is changing the time but remaining out by 3 minutes in each time zone.....

See attached Chronyc sources.

 

[leesteken]

It is syncing to some degree because if I change time zone it is changing the time but remaining out by 3 minutes in each time zone.....

The time zone is just a presentation and not related to sync.

See attached Chronyc sources.

None of your sources are reachable and therefore there is no syncing with any outside source(s). Check your network settings and DNS.

 

[UdoB]

See attached Chronyc sources.

Yeah, my post #2 was not really clever. My excerpt and your screenshot seems to show some configured sources the tool does know about. But it does not show the actually used sources.

man chronyc shows several command you can evaluate. To see the actually connected sources (including the time offset) I can use:

~$ chronyc sourcestats
Name/IP Address            NP  NR  Span  Frequency  Freq Skew  Offset  Std Dev
==============================================================================
time.cloudflare.com        19  10  1167     +0.380      3.104  +1066us  1208us
web.k-cix.de                8   4   453     +1.587     18.621  -1638us  1544us
nobody.yourvserver.net     18  11  1163     +0.476      1.553   +698us   541us
s5.vonderste.in            11   7   645     -3.205      4.664   +371us   620us
fb6591.cos.lan              7   5   387     -0.123      0.598  +1102us    34us

You may re-install chrony by issuing apt --reinstall install chrony

The daemon must be running to do its job:

 ~$ systemctl  status chronyd
● chrony.service - chrony, an NTP client/server
     Loaded: loaded (/lib/systemd/system/chrony.service; enabled; preset: enabled)
     Active: active (running) since Mon 2025-03-03 08:37:15 CET; 6 days ago

 

[BobhWasatch]

The "reach" field in the "chronyc sources" output is one byte in octal. A bit is set each time a response is received. So if it says 377, that means it got a reply for the last 8 queries. Having it be zero means that it is not receiving replies at all. This in turn could be caused by a number of things, including incorrect DNS setup, a wrong route, or a firewall blocking either the outgoing queries to UDP port 123 or the replies from that port.

 

[Jackmynet]

Hi all, still no further forward with this mess. I have confirmed the dns is all working absolutely correctly but this node does not want to siply sync its time.

See attached I can even confirm reachability to the addresses that the chronyc status output says it cannot reach.

Anyone any suggestions on this?

 

[BobhWasatch]

So DNS is working and routing is working. Which leaves a firewall somewhere that blocks UDP port 123 either inbound or outbound.

ETA: Sometimes, especially on corporate networks, the firewall is set up to be an NTP server and blocks use of external servers.