# 分层时间同步架构
层级1（Stratum 1）
– 外部时间源（GPS、原子钟）
– 连接外部NTP服务器
– 提供最准确的时间

层级2（Stratum 2）
– 内部主时间服务器
– 同步Stratum 1服务器
– 为内部网络提供时间服务

层级3（Stratum 3）
– 内部从时间服务器
– 同步Stratum 2服务器
– 为客户端提供时间服务

客户端
– 同步内部时间服务器
– 配置多个时间源
– 定期验证时间同步

# 架构规划建议
1. 主时间服务器
– 至少部署2台主时间服务器
– 连接多个外部时间源
– 配置高可用

2. 从时间服务器
– 根据网络规模部署
– 分布在不同网络区域
– 负载均衡

3. 客户端配置
– 配置多个时间服务器
– 设置合理的同步间隔
– 监控同步状态

# 时间服务器规划
1. 硬件要求
– CPU: 2核以上
– 内存: 2GB以上
– 网络: 稳定的网络连接
– 存储: 20GB以上

2. 软件要求
– 操作系统: RHEL LINUX 10
– 时间服务: Chrony
– 防火墙: 开放UDP 123端口

3. 网络要求
– 可访问外部时间源
– 内部网络可达
– 网络延迟低

4. 外部时间源推荐
– pool.ntp.org（公共NTP池）
– time.nist.gov（NIST时间服务器）
– cn.pool.ntp.org（中国NTP池）
– 阿里云NTP: ntp.aliyun.com
– 腾讯云NTP: ntp.tencent.com

# 时间服务器数量规划
服务器数量 | 客户端数量
————|———–
2台 | 1-500台
3台 | 500-2000台
5台 | 2000-10000台
7台以上 | 10000台以上

# 时间同步策略
1. 同步间隔策略
– 初始同步：快速同步
– 稳定同步：定期同步
– 异常处理：立即同步

2. 时间调整策略
– 小偏差：平滑调整（slew）
– 大偏差：快速调整（step）
– 阈值设置：根据业务需求

3. 容错策略
– 多时间源配置
– 本地时钟备份
– 自动故障切换

4. 监控策略
– 实时监控同步状态
– 告警阈值设置
– 定期检查日志

# Chrony配置参数建议
# 时间偏差阈值
makestep 1.0 3
# 如果时间偏差超过1秒，前3次更新时快速调整

# 最小同步间隔
minsources 2
# 至少需要2个时间源才能同步

# 最大同步间隔
maxupdateskew 100.0
# 最大更新偏差

# RTC同步
rtcsync
# 自动同步RTC时钟

# 日志级别
log measurements statistics tracking
# 记录测量、统计和跟踪日志

# 安装Chrony
# dnf install -y chrony
Last metadata expiration check: 0:00:00 ago on Fri Apr 2 14:00:00 2026.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
chrony x86_64 4.2-1.el10 rhel-baseos 320 k

Transaction Summary
================================================================================
Install 1 Package

Total download size: 320 k
Installed size: 750 k
Downloading Packages:
chrony-4.2-1.el10.x86_64.rpm 320 kB/s | 320 kB 00:01
——————————————————————————–
Total 320 kB/s | 320 kB 00:01
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : chrony-4.2-1.el10.x86_64 1/1
Running scriptlet: chrony-4.2-1.el10.x86_64 1/1
Verifying : chrony-4.2-1.el10.x86_64 1/1

Installed:
chrony-4.2-1.el10.x86_64

Complete!

# 查看Chrony版本
# chronyd –version
chronyd (chrony) version 4.2
Copyright (C) 1997-2003, 2007, 2009-2021 Richard P. Curnow and others
chrony comes with ABSOLUTELY NO WARRANTY. This is free software, and
you are welcome to redistribute it under certain conditions. See the
GNU General Public License version 2 for details.

# 查看默认配置文件
# cat /etc/chrony.conf
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
pool 2.rhel.pool.ntp.org iburst

# Record the rate at which the system clock gains/loses time.
driftfile /var/lib/chrony/drift

# Allow the system clock to be stepped in the first three updates
# if its offset is larger than 1 second.
makestep 1.0 3

# Enable kernel synchronization of the real-time clock (RTC).
rtcsync

# Enable hardware timestamping on all interfaces that support it.
#hwtimestamp *

# Increase the minimum number of selectable sources required to adjust
# the system clock.
#minsources 2

# Specify directory for log files.
logdir /var/log/chrony

# Select which information is logged.
#log measurements statistics tracking

# 备份默认配置
# cp /etc/chrony.conf /etc/chrony.conf.bak

# 配置Chrony客户端
# cat > /etc/chrony.conf << 'EOF' # 使用国内NTP服务器池 server ntp.aliyun.com iburst server ntp.tencent.com iburst server cn.pool.ntp.org iburst server 0.cn.pool.ntp.org iburst server 1.cn.pool.ntp.org iburst # 记录时钟漂移 driftfile /var/lib/chrony/drift # 时间调整策略 makestep 1.0 3 # 启用RTC同步 rtcsync # 启用硬件时间戳 hwtimestamp * # 最小时间源数量 minsources 2 # 日志配置 logdir /var/log/chrony log measurements statistics tracking # 允许本地网络同步 allow 192.168.0.0/16 allow 10.0.0.0/8 # 本地时钟作为备用 local stratum 10 EOF # 启动并启用Chrony服务 # systemctl enable --now chronyd Created symlink /etc/systemd/system/multi-user.target.wants/chronyd.service → /usr/lib/systemd/system/chronyd.service. # 检查Chrony服务状态 # systemctl status chronyd ● chronyd.service - NTP client/server Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled) Active: active (running) since Fri 2026-04-02 14:00:00 CST; 1min ago Docs: man:chronyd(8) man:chrony.conf(5) Main PID: 12345 (chronyd) Tasks: 1 (limit: 23456) Memory: 1.5M CPU: 234ms CGroup: /system.slice/chronyd.service └─12345 /usr/sbin/chronyd Apr 02 14:00:00 rhel10-server systemd[1]: Starting NTP client/server... Apr 02 14:00:00 rhel10-server chronyd[12345]: chronyd version 4.2 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +NTS +SECHASH +IPV6 +DEBUG) Apr 02 14:00:00 rhel10-server chronyd[12345]: Frequency -5.234 +/- 0.123 ppm read from /var/lib/chrony/drift Apr 02 14:00:00 rhel10-server systemd[1]: Started NTP client/server. # 配置防火墙 # firewall-cmd --permanent --add-service=ntp success # firewall-cmd --reload success # 检查防火墙规则 # firewall-cmd --list-all | grep ntp services: cockpit dhcpv6-client ntp ssh

# 配置主时间服务器
# cat > /etc/chrony.conf << 'EOF' # 外部时间源 server time.nist.gov iburst server time.cloudflare.com iburst server ntp.ubuntu.com iburst server 0.pool.ntp.org iburst server 1.pool.ntp.org iburst server 2.pool.ntp.org iburst # 记录时钟漂移 driftfile /var/lib/chrony/drift # 时间调整策略 makestep 0.1 3 # 启用RTC同步 rtcsync # 启用硬件时间戳 hwtimestamp eth0 # 最小时间源数量 minsources 3 # 日志配置 logdir /var/log/chrony log measurements statistics tracking # 允许内部网络同步 allow 192.168.0.0/16 allow 10.0.0.0/8 allow 172.16.0.0/12 # 本地时钟作为备用 local stratum 10 # 统计信息 statsdir /var/log/chrony statistics measurements EOF # 重启Chrony服务 # systemctl restart chronyd # 检查时间源状态 # chronyc sources MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^? time.nist.gov 1 6 377 45 +12ms[ +12ms] +/- 123ms ^? time.cloudflare.com 3 6 377 47 -234us[-234us] +/- 56ms ^? ntp.ubuntu.com 2 6 377 49 -456us[-456us] +/- 89ms ^? 0.pool.ntp.org 2 6 377 51 -123us[-123us] +/- 67ms ^? 1.pool.ntp.org 2 6 377 53 -789us[-789us] +/- 78ms ^? 2.pool.ntp.org 2 6 377 55 -345us[-345us] +/- 45ms # 检查时间同步状态 # chronyc tracking Reference ID : CB007B45 (time.cloudflare.com) Stratum : 4 Ref time (UTC) : Fri Apr 02 06:00:00 2026 System time : 0.000000123 seconds fast of NTP time Last offset : -0.000234567 seconds RMS offset : 0.000123456 seconds Frequency : 5.234 ppm fast Residual freq : -0.001 ppm Skew : 0.123 ppm Root delay : 0.012345 seconds Root dispersion : 0.001234 seconds Update interval : 64.2 seconds Leap status : Normal # 检查时间源统计 # chronyc sourcestats Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev ============================================================================== time.nist.gov 12 7 23m -0.123 1.234 +123us 456us time.cloudflare.com 15 9 25m +0.234 0.987 -234us 345us ntp.ubuntu.com 14 8 24m -0.345 1.123 -456us 567us 0.pool.ntp.org 13 7 23m +0.456 1.345 -123us 432us 1.pool.ntp.org 12 6 22m -0.567 1.567 -789us 654us 2.pool.ntp.org 11 5 21m +0.678 1.789 -345us 543us # 手动同步时间 # chronyc makestep 200 OK # 查看客户端连接 # chronyc clients Hostname NTP Drop Int IntL Last Cmd Drop Int Last =============================================================================== 192.168.1.11 0 0 - - - 1 0 - 0 192.168.1.12 0 0 - - - 1 0 - 0 192.168.1.13 0 0 - - - 1 0 - 0

# 配置客户端
# cat > /etc/chrony.conf << 'EOF' # 内部时间服务器 server 192.168.1.10 iburst server 192.168.1.11 iburst server 192.168.1.12 iburst # 备用外部时间源 server ntp.aliyun.com iburst server cn.pool.ntp.org iburst # 记录时钟漂移 driftfile /var/lib/chrony/drift # 时间调整策略 makestep 1.0 3 # 启用RTC同步 rtcsync # 最小时间源数量 minsources 2 # 日志配置 logdir /var/log/chrony log measurements statistics tracking EOF # 重启Chrony服务 # systemctl restart chronyd # 检查时间源状态 # chronyc sources MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^* 192.168.1.10 3 6 377 15 +123us[ +123us] +/- 12ms ^+ 192.168.1.11 3 6 377 17 -234us[-234us] +/- 15ms ^+ 192.168.1.12 3 6 377 19 -456us[-456us] +/- 18ms ^? ntp.aliyun.com 2 6 377 21 -789us[-789us] +/- 45ms ^? cn.pool.ntp.org 2 6 377 23 -345us[-345us] +/- 34ms # 检查时间同步状态 # chronyc tracking Reference ID : C0A8010A (192.168.1.10) Stratum : 4 Ref time (UTC) : Fri Apr 02 06:00:00 2026 System time : 0.000000456 seconds slow of NTP time Last offset : +0.000123456 seconds RMS offset : 0.000234567 seconds Frequency : 5.234 ppm slow Residual freq : +0.001 ppm Skew : 0.234 ppm Root delay : 0.001234 seconds Root dispersion : 0.000567 seconds Update interval : 64.2 seconds Leap status : Normal # 验证时间同步 # timedatectl status Local time: Fri 2026-04-02 14:00:00 CST Universal time: Fri 2026-04-02 06:00:00 UTC RTC time: Fri 2026-04-02 06:00:00 Time zone: Asia/Shanghai (CST, +0800) System clock synchronized: yes NTP service: active RTC in local TZ: no # 检查时间偏差 # chronyc tracking | grep "System time" System time : 0.000000456 seconds slow of NTP time

# 企业级时间同步架构
架构设计:
– 2台主时间服务器（Stratum 2）
– 4台从时间服务器（Stratum 3）
– 所有客户端配置多个时间源

# 主时间服务器1配置
# cat > /etc/chrony.conf << 'EOF' # 外部时间源 server time.nist.gov iburst prefer server time.cloudflare.com iburst server ntp.ubuntu.com iburst pool pool.ntp.org iburst # 记录时钟漂移 driftfile /var/lib/chrony/drift # 时间调整策略 makestep 0.1 3 # 启用RTC同步 rtcsync # 最小时间源数量 minsources 3 # 日志配置 logdir /var/log/chrony log measurements statistics tracking # 允许内部网络同步 allow 192.168.0.0/16 allow 10.0.0.0/8 # 本地时钟作为备用 local stratum 10 # 统计信息 statsdir /var/log/chrony statistics measurements EOF # 主时间服务器2配置（类似，但prefer不同的服务器） # cat > /etc/chrony.conf << 'EOF' server time.cloudflare.com iburst prefer server time.nist.gov iburst server ntp.ubuntu.com iburst pool pool.ntp.org iburst # ... 其他配置相同 EOF # 从时间服务器配置 # cat > /etc/chrony.conf << 'EOF' # 内部主时间服务器 server 192.168.1.10 iburst prefer server 192.168.1.11 iburst # 备用外部时间源 server ntp.aliyun.com iburst server cn.pool.ntp.org iburst # 记录时钟漂移 driftfile /var/lib/chrony/drift # 时间调整策略 makestep 0.5 3 # 启用RTC同步 rtcsync # 最小时间源数量 minsources 2 # 日志配置 logdir /var/log/chrony log measurements statistics tracking # 允许客户端同步 allow 192.168.0.0/16 allow 10.0.0.0/8 # 本地时钟作为备用 local stratum 10 EOF # 客户端配置脚本 # cat > /fgedu/shell/setup-chrony-client.sh << 'EOF' #!/bin/bash # from:www.itpux.com.qq113257174.wx:itpux-com # 配置Chrony客户端 cat > /etc/chrony.conf << CONF # 内部时间服务器 server 192.168.1.10 iburst server 192.168.1.11 iburst server 192.168.1.12 iburst server 192.168.1.13 iburst server 192.168.1.14 iburst server 192.168.1.15 iburst # 备用外部时间源 server ntp.aliyun.com iburst server cn.pool.ntp.org iburst # 记录时钟漂移 driftfile /var/lib/chrony/drift # 时间调整策略 makestep 1.0 3 # 启用RTC同步 rtcsync # 最小时间源数量 minsources 2 # 日志配置 logdir /var/log/chrony log measurements statistics tracking CONF # 重启Chrony服务 systemctl restart chronyd # 验证时间同步 sleep 5 chronyc sources chronyc tracking echo "时间同步配置完成！" EOF # 执行客户端配置 # chmod +x /fgedu/shell/setup-chrony-client.sh # /fgedu/shell/setup-chrony-client.sh MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^* 192.168.1.10 3 6 377 15 +123us[ +123us] +/- 12ms ^+ 192.168.1.11 3 6 377 17 -234us[-234us] +/- 15ms ^+ 192.168.1.12 3 6 377 19 -456us[-456us] +/- 18ms ^+ 192.168.1.13 3 6 377 21 -789us[-789us] +/- 21ms ^+ 192.168.1.14 3 6 377 23 -345us[-345us] +/- 24ms ^+ 192.168.1.15 3 6 377 25 -567us[-567us] +/- 27ms ^? ntp.aliyun.com 2 6 377 27 -890us[-890us] +/- 45ms ^? cn.pool.ntp.org 2 6 377 29 -432us[-432us] +/- 34ms Reference ID : C0A8010A (192.168.1.10) Stratum : 4 Ref time (UTC) : Fri Apr 02 06:00:00 2026 System time : 0.000000123 seconds fast of NTP time Last offset : +0.000123456 seconds RMS offset : 0.000234567 seconds Frequency : 5.234 ppm fast Residual freq : +0.001 ppm Skew : 0.234 ppm Root delay : 0.001234 seconds Root dispersion : 0.000567 seconds Update interval : 64.2 seconds Leap status : Normal 时间同步配置完成！

# 创建Ansible Playbook
# cat > /tmp/setup-chrony.yml << 'EOF' --- - name: Setup Chrony for Large Scale Environment hosts: all become: yes vars: time_servers: - "192.168.1.10" - "192.168.1.11" - "192.168.1.12" - "192.168.1.13" - "192.168.1.14" - "192.168.1.15" external_servers: - "ntp.aliyun.com" - "cn.pool.ntp.org" tasks: - name: Install Chrony dnf: name: chrony state: present - name: Configure Chrony template: src: chrony.conf.j2 dest: /etc/chrony.conf owner: root group: root mode: '0644' backup: yes notify: Restart Chrony - name: Start and enable Chrony systemd: name: chronyd state: started enabled: yes - name: Configure firewall firewalld: service: ntp permanent: yes state: enabled notify: Reload firewall - name: Wait for time sync wait_for: timeout: 10 - name: Check time sync status command: chronyc tracking register: sync_status changed_when: false - name: Display sync status debug: var: sync_status.stdout_lines handlers: - name: Restart Chrony systemd: name: chronyd state: restarted - name: Reload firewall command: firewall-cmd --reload EOF # 创建Chrony配置模板 # cat > /tmp/chrony.conf.j2 << 'EOF' # Internal Time Servers {% for server in time_servers %} server {{ server }} iburst {% endfor %} # External Time Servers (Backup) {% for server in external_servers %} server {{ server }} iburst {% endfor %} # Drift file driftfile /var/lib/chrony/drift # Time adjustment makestep 1.0 3 # RTC sync rtcsync # Minimum sources minsources 2 # Logging logdir /var/log/chrony log measurements statistics tracking EOF # 执行Ansible Playbook # ansible-playbook -i /etc/ansible/hosts /tmp/setup-chrony.yml PLAY [Setup Chrony for Large Scale Environment] ******************************** TASK [Gathering Facts] ********************************************************* ok: [192.168.1.11] ok: [192.168.1.12] ok: [192.168.1.13] ok: [192.168.1.14] ok: [192.168.1.15] TASK [Install Chrony] ********************************************************** ok: [192.168.1.11] ok: [192.168.1.12] ok: [192.168.1.13] ok: [192.168.1.14] ok: [192.168.1.15] TASK [Configure Chrony] ******************************************************** changed: [192.168.1.11] changed: [192.168.1.12] changed: [192.168.1.13] changed: [192.168.1.14] changed: [192.168.1.15] TASK [Start and enable Chrony] ************************************************* ok: [192.168.1.11] ok: [192.168.1.12] ok: [192.168.1.13] ok: [192.168.1.14] ok: [192.168.1.15] TASK [Configure firewall] ****************************************************** changed: [192.168.1.11] changed: [192.168.1.12] changed: [192.168.1.13] changed: [192.168.1.14] changed: [192.168.1.15] TASK [Wait for time sync] ****************************************************** ok: [192.168.1.11] ok: [192.168.1.12] ok: [192.168.1.13] ok: [192.168.1.14] ok: [192.168.1.15] TASK [Check time sync status] ************************************************** ok: [192.168.1.11] ok: [192.168.1.12] ok: [192.168.1.13] ok: [192.168.1.14] ok: [192.168.1.15] TASK [Display sync status] ***************************************************** ok: [192.168.1.11] => {
“sync_status.stdout_lines”: [
“Reference ID : C0A8010A (192.168.1.10)”,
“Stratum : 4”,
“Ref time (UTC) : Fri Apr 02 06:00:00 2026”,
“System time : 0.000000123 seconds fast of NTP time”,
“Last offset : +0.000123456 seconds”,
“RMS offset : 0.000234567 seconds”,
“Frequency : 5.234 ppm fast”,
“Residual freq : +0.001 ppm”,
“Skew : 0.234 ppm”,
“Root delay : 0.001234 seconds”,
“Root dispersion : 0.000567 seconds”,
“Update interval : 64.2 seconds”,
“Leap status : Normal”
]
}
…

RUNNING HANDLER [Restart Chrony] ************************************************
changed: [192.168.1.11]
changed: [192.168.1.12]
changed: [192.168.1.13]
changed: [192.168.1.14]
changed: [192.168.1.15]

RUNNING HANDLER [Reload firewall] **********************************************
changed: [192.168.1.11]
changed: [192.168.1.12]
changed: [192.168.1.13]
changed: [192.168.1.14]
changed: [192.168.1.15]

PLAY RECAP *********************************************************************
192.168.1.11 : ok=9 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
192.168.1.12 : ok=9 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
192.168.1.13 : ok=9 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
192.168.1.14 : ok=9 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
192.168.1.15 : ok=9 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

# 问题1: 时间无法同步
# 检查Chrony服务状态
# systemctl status chronyd
● chronyd.service – NTP client/server
Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2026-04-02 14:00:00 CST; 1h ago

# 检查时间源状态
# chronyc sources
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^? 192.168.1.10 0 6 0 – +0ns[ +0ns] +/- 0ns
^? 192.168.1.11 0 6 0 – +0ns[ +0ns] +/- 0ns

# Reach为0表示无法连接时间服务器
# 检查网络连通性
# ping -c 3 192.168.1.10
PING 192.168.1.10 (192.168.1.10) 56(84) bytes of data.
64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=0.234 ms
64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=0.123 ms
64 bytes from 192.168.1.10: icmp_seq=3 ttl=64 time=0.234 ms

# 检查防火墙
# firewall-cmd –list-all | grep ntp
# 无输出，说明NTP端口未开放

# 开放NTP端口
# firewall-cmd –permanent –add-service=ntp
success
# firewall-cmd –reload
success

# 重启Chrony服务
# systemctl restart chronyd

# 再次检查时间源状态
# chronyc sources
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 192.168.1.10 3 6 377 15 +123us[ +123us] +/- 12ms
^+ 192.168.1.11 3 6 377 17 -234us[-234us] +/- 15ms

# 问题2: 时间偏差过大
# 检查时间偏差
# chronyc tracking | grep “System time”
System time : 12.345678901 seconds fast of NTP time

# 手动同步时间
# chronyc makestep
200 OK

# 检查时间偏差
# chronyc tracking | grep “System time”
System time : 0.000000123 seconds fast of NTP time

# 问题3: 时间服务器无法访问外网
# 检查DNS解析
# nslookup pool.ntp.org
Server: 192.168.1.1
Address: 192.168.1.1#53

Non-authoritative answer:
Name: pool.ntp.org
Address: 202.118.1.46
Name: pool.ntp.org
Address: 202.112.29.82
Name: pool.ntp.org
Address: 202.112.26.38

# 检查网络连通性
# ping -c 3 pool.ntp.org
PING pool.ntp.org (202.118.1.46) 56(84) bytes of data.
64 bytes from 202.118.1.46: icmp_seq=1 ttl=128 time=25.4 ms
64 bytes from 202.118.1.46: icmp_seq=2 ttl=128 time=24.8 ms
64 bytes from 202.118.1.46: icmp_seq=3 ttl=128 time=25.1 ms

# 检查UDP端口
# nc -uzv pool.ntp.org 123
Connection to pool.ntp.org 123 port [udp/ntp] succeeded!

# 查看Chrony日志
# tail -50 /var/log/chrony/chrony.log
2026-04-02 14:00:00 chronyd[12345]: chronyd version 4.2 starting
2026-04-02 14:00:00 chronyd[12345]: Frequency -5.234 +/- 0.123 ppm read from /var/lib/chrony/drift
2026-04-02 14:00:05 chronyd[12345]: Selected source 192.168.1.10
2026-04-02 14:00:05 chronyd[12345]: Source 192.168.1.10 online
2026-04-02 14:00:05 chronyd[12345]: Source 192.168.1.11 online
2026-04-02 14:00:10 chronyd[12345]: System clock wrong by 12.345678 seconds, adjustment started
2026-04-02 14:00:10 chronyd[12345]: System clock was stepped by 12.345678 seconds

# 时间同步最佳实践
1. 架构设计
– 采用分层架构
– 部署多台时间服务器
– 配置多个时间源

2. 配置管理
– 统一配置模板
– 自动化部署
– 定期验证

3. 监控告警
– 监控时间偏差
– 监控同步状态
– 设置告警阈值

4. 故障处理
– 建立应急预案
– 记录故障案例
– 定期演练

# 常用监控命令
# 检查时间同步状态
chronyc tracking

# 检查时间源状态
chronyc sources

# 检查时间源统计
chronyc sourcestats

# 检查客户端连接
chronyc clients

# 手动同步时间
chronyc makestep

# 检查时间偏差
chronyc tracking | grep “System time”

# 时间同步检查清单
□ 1. Chrony服务状态
systemctl status chronyd

□ 2. 时间源配置
cat /etc/chrony.conf

□ 3. 时间源状态
chronyc sources

□ 4. 时间同步状态
chronyc tracking

□ 5. 时间偏差检查
chronyc tracking | grep “System time”

□ 6. 防火墙配置
firewall-cmd –list-all | grep ntp

□ 7. 网络连通性
ping time-server

□ 8. DNS解析
nslookup pool.ntp.org

□ 9. 日志检查
tail -50 /var/log/chrony/chrony.log

□ 10. 客户端连接
chronyc clients

□ 11. 时间源统计
chronyc sourcestats

□ 12. 系统时间
timedatectl status

□ 13. 硬件时钟
hwclock –show

□ 14. 时区配置
timedatectl show | grep Timezone

□ 15. NTP端口
netstat -tuln | grep 123

# 推荐的时间同步工具
1. Chrony
– RHEL 10默认时间服务
– 同步速度快
– 网络适应性强

2. NTP
– 传统时间服务
– 稳定可靠
– 广泛支持

3. systemd-timesyncd
– 轻量级时间服务
– 适合简单场景
– 资源占用少

4. ntpdate
– 一次性时间同步
– 适合手动同步
– 不适合长期运行

# 常用时间同步命令
# 查看当前时间
date

# 查看硬件时钟
hwclock –show

# 同步硬件时钟到系统时间
hwclock –hctosys

# 同步系统时间到硬件时钟
hwclock –systohc

# 查看时区
timedatectl show | grep Timezone

# 设置时区
timedatectl set-timezone Asia/Shanghai

# 查看时间同步状态
timedatectl status

# 启用NTP同步
timedatectl set-ntp yes

# 禁用NTP同步
timedatectl set-ntp no