Time · XB Field Notes

NOW and clock_timestamp differ by when they freeze

Thu, 13 Jan 2028 00:00:00 +0000

PostgreSQL offers several meanings of “current time.” A transaction timestamp identifies the beginning of a transaction, a statement timestamp identifies a command’s arrival, and a wall-clock reading samples the current clock during evaluation. Choosing among them changes the meaning of audit fields, expiration checks, and observations made during long-running work.

A transaction has one start time

now(), transaction_timestamp(), and CURRENT_TIMESTAMP without a precision argument return the same transaction-start instant. They remain fixed throughout an explicit transaction, even if later statements run seconds or minutes afterward. CURRENT_TIMESTAMP can take a precision argument that rounds its result; that formatting precision is separate from when the time is sampled.

This stability is useful when related rows should share one logical transaction time. It does not record the exact moment each row was inserted, nor the eventual commit time. A transaction can wait for locks or perform substantial work before an insert, and it can still roll back. Calling a column created_at does not resolve which of these events its default actually represents.

In ordinary autocommit use, successive statements normally run in separate transactions, so now can appear to advance on every statement. That observation does not change the function’s contract. Introducing an explicit transaction later can expose an assumption that a supposedly live timestamp was actually fixed much earlier.

Statement markers and live readings

statement_timestamp() reports the receipt time of the latest command message from the client. It remains stable during that command’s execution and can differ from the transaction timestamp in later commands. Multiple SQL commands sent in one protocol message can share this marker; it is not necessarily the instant each internal operation starts after waiting.

clock_timestamp() reads the current wall clock when evaluated and can change within a single statement. Separate calls are not guaranteed to be distinct, because clocks have finite precision. The value also is not a monotonic timer: clock adjustments can affect differences between readings. Use a suitable monotonic clock for elapsed-duration guarantees rather than treating database wall time as an unconditionally increasing counter.

None of these values alone establishes commit order or a unique event identity across concurrent transactions. Choose a transaction marker for consistent related fields, a statement marker for command timing, or a wall-clock observation when that observation is what the application needs. Keep identity and ordering requirements explicit instead of expecting a timestamp to provide them automatically.

When it breaks

An expiration test using now inside a long transaction continues comparing against that transaction’s start. A condition that was true at the beginning can remain true after wall time has passed the deadline. Conversely, replacing every default with clock_timestamp can give related rows different values when they were meant to share a logical creation time. Decide which event the column represents before changing functions.

The special literal TIMESTAMPTZ 'now' is another trap in a column default. PostgreSQL converts it when the constant is parsed, so later inserts can keep receiving the table-creation time. DEFAULT now() is a function call evaluated when the default is used. Similar-looking spelling does not imply the same evaluation lifetime.

These functions return timestamptz values. Changing the session time zone changes how an instant is displayed, not the stored instant itself. Timestamptz does not preserve the originally supplied zone name. If the application must remember that original zone, model it separately rather than inferring it from a later display offset.

Check it quickly

Save this as timestamps.sql and run psql -X -v ON_ERROR_STOP=1 -f timestamps.sql in a disposable PostgreSQL 18 database. Keep psql’s normal autocommit behavior outside the explicit transaction. The second experiment needs separate insert transactions, and all tables are temporary.

\set ON_ERROR_STOP on
BEGIN;
SET LOCAL timezone='UTC';
CREATE TEMP TABLE moments (step integer,tx timestamptz,statement timestamptz,wall timestamptz);
INSERT INTO moments VALUES (1,now(),statement_timestamp(),clock_timestamp());
SELECT pg_sleep(0.03);
INSERT INTO moments VALUES (2,CURRENT_TIMESTAMP,statement_timestamp(),clock_timestamp());
SELECT step,tx,statement,wall FROM moments ORDER BY step;
SELECT min(tx)=max(tx) AS one_transaction_time,
 count(DISTINCT statement)=2 AS two_statement_times FROM moments;
SELECT now()=transaction_timestamp() AND now()=CURRENT_TIMESTAMP AS aliases;
SELECT extract(epoch FROM now()) AS instant_utc;
SET LOCAL timezone='Asia/Shanghai';
SELECT now() AS same_instant_different_display,extract(epoch FROM now()) AS instant_shanghai;
DO $$ BEGIN
 IF (SELECT min(tx)=max(tx) FROM moments) IS DISTINCT FROM true THEN
 RAISE EXCEPTION 'transaction time changed';
 END IF;
 IF now() IS DISTINCT FROM transaction_timestamp() THEN RAISE EXCEPTION 'aliases differ'; END IF;
 IF (SELECT tx FROM moments WHERE step=1) IS DISTINCT FROM now() THEN
 RAISE EXCEPTION 'time zone changed the instant';
 END IF;
END $$;
ROLLBACK;
CREATE TEMP TABLE defaults_demo (
 id integer,
 parsed timestamptz DEFAULT TIMESTAMPTZ 'now',
 called timestamptz DEFAULT now()
);
INSERT INTO defaults_demo (id) VALUES (1);
SELECT pg_sleep(0.03);
INSERT INTO defaults_demo (id) VALUES (2);
SELECT id,parsed,called FROM defaults_demo ORDER BY id;
SELECT min(parsed)=max(parsed) AS one_parsed_constant,
 count(DISTINCT called)=2 AS two_insert_transaction_times FROM defaults_demo;
DO $$ BEGIN
 IF (SELECT min(parsed)=max(parsed) FROM defaults_demo) IS DISTINCT FROM true THEN
 RAISE EXCEPTION 'parsed default was evaluated again';
 END IF;
END $$;
DROP TABLE defaults_demo;

On PostgreSQL 18.6, the first two rows shared tx while their statement and wall readings differed. Alias comparison returned true. Switching from UTC to Asia/Shanghai changed the visible offset to plus eight hours, while the two epoch values remained identical. Assertions check transaction stability and the unchanged instant.

After rollback, the default experiment inserted two rows in separate transactions. Both retained the same parsed literal, while called advanced between inserts. The short sleeps make the difference observable in this run, not a clock-resolution or scheduling guarantee. The final DROP removes the second temporary table; session termination also removes temporary objects if an assertion stops execution early.

Sources

PostgreSQL date/time functions, transaction, statement, wall-clock, and default evaluation semantics, checked 2026-09-10.
PostgreSQL date/time types, timestamptz storage, display, and special input literals, checked 2026-09-10.

Check timesyncd’s service state and clock evidence separately

Thu, 11 Mar 2027 00:00:00 +0000

systemd-timesyncd is a minimal SNTP client for synchronizing the local system clock against configured time sources. It can help keep certificate checks and wall-clock timestamps meaningful, but it does not provide an unconditional accuracy guarantee. Whether the daemon can run, whether it receives acceptable samples, and whether the system reports synchronization are separate facts to establish.

When it breaks

The daemon does not always smooth corrections. The documented behavior steps the clock for large offsets and adjusts it gradually for smaller differences. A machine starting far from correct time may therefore experience a discontinuity. Use monotonic clocks for elapsed-duration measurements, and design applications that interpret wall-clock timestamps to handle corrections rather than assuming time always moves smoothly.

FallbackNTP is not a general emergency list used whenever an explicitly configured server becomes unreachable. It applies when no other server information is known. Global NTP entries and per-link sources supplied through networkd take precedence over that fallback. Inspect the actual source selection and configuration drop-ins before concluding that a particular backup server must have been contacted.

An unsynchronized state also does not prove UDP traffic is blocked. A service can be absent, disabled, excluded by unit conditions, unable to adjust time, or rejecting unsuitable samples. Conversely, a global synchronization property does not identify which process supplied time. Distinguish the manager’s service state, the time client’s observations, and the kernel-level synchronization indication.

Check it quickly

This failure-mode exercise runs as root inside a disposable Debian 12 Docker container with systemd 252.39 as PID 1. Its init process was launched through /usr/bin/setpriv --bounding-set=-sys_time,-sys_module /sbin/init; the capability restriction prevents adjustment of the Docker VM’s shared clock. The script verifies that prerequisite before requesting any service start, and requires the packaged container-exclusion condition:

from pathlib import Path
import json,subprocess

def run(*args):
 result=subprocess.run(args,text=True,capture_output=True,timeout=10)
 assert result.returncode==0,(args,result.stderr)
 return result.stdout.strip()
def properties(unit):
 output=run('systemctl','show',unit,'-p','ActiveState','-p','SubState','-p','MainPID','-p','ConditionResult')
 return dict(line.split('=',1) for line in output.splitlines())
# This failure-mode exercise requires an isolated container that cannot set time.
status=dict(line.split(':',1) for line in Path('/proc/1/status').read_text().splitlines() if ':' in line)
assert int(status['CapBnd'].strip(),16)&(1<<25)==0,'PID 1 must lack CAP_SYS_TIME'
assert run('systemd-detect-virt','--container')=='docker'
unit='systemd-timesyncd.service';definition=run('systemctl','cat',unit)
assert 'ConditionCapability=CAP_SYS_TIME' in definition
assert 'ConditionVirtualization=!container' in definition
assert properties(unit)['ActiveState']=='inactive'
run('systemctl','start',unit)
state=properties(unit)
assert state=={'MainPID':'0','ActiveState':'inactive','SubState':'dead','ConditionResult':'no'},state
clock=dict(line.split('=',1) for line in run('timedatectl','show','-p','CanNTP','-p','NTP','-p','NTPSynchronized').splitlines())
assert all(value in ('yes','no') for value in clock.values())
print('start command returned zero; unit stayed inactive with PID 0 and failed conditions')
print('clock properties:',json.dumps(clock,sort_keys=True))
print('PID 1 lacks time-setting capability; Docker condition also excludes this packaged service')
print('no clock-setting command was issued and no NTP synchronization was claimed')

The start command returns zero, yet the unit remains inactive with main PID zero and ConditionResult=no. A skipped conditional activation is not the same as a successfully running daemon. The fixture’s packaged unit requires the time-setting capability and excludes containers; this environment satisfies neither prerequisite. The observed outcome is therefore explained before any theory about blocked NTP packets is needed.

The recorded clock properties are CanNTP=yes, NTP=no, and NTPSynchronized=no. They describe different aspects of the system’s time-service interface. In particular, knowing that NTP service support is available does not make that service active or establish that the clock has synchronized. The script reports the actual values rather than replacing them with an assumed healthy result.

No clock-setting command is issued, and no successful NTP exchange or clock adjustment is claimed. This verifies a real activation failure mode in a container that cannot set time. Testing successful clock discipline requires an appropriate machine or independently clocked virtual machine with the required authority and a reachable, suitable time source.

When the daemon is actually running, its timedatectl timesync-status interface provides client-specific server and synchronization information. Check service state before relying on that interface; a request to an unavailable service can wait for D-Bus activation and time out. The container probe reached its five-second observation limit, which was treated as unavailable evidence, not a successful synchronization check.

Build a time requirement that can be verified

Choose sources appropriate to the network and inspect offset, delay, and accepted-source quality over time. Reachability alone does not make a server accurate or trustworthy. Polling and root-distance settings influence sample handling; they do not turn a minimal client into a complete time-distribution service or establish an accuracy service-level agreement by themselves.

The saved /var/lib/systemd/timesync/clock timestamp helps initialize time across boots without a reliable hardware clock. It can also be updated periodically without a recent synchronization, so its existence is not proof of a fresh accepted network sample. Rough initialization and synchronization to a reference clock are different milestones.

If dependent work requires synchronized time, configure and verify the appropriate wait service and ordering after time-sync.target. Starting timesyncd alone does not delay every application until an accurate reference is reached. Keep the startup requirement and runtime monitoring explicit, and use the evidence from the actual deployment rather than a generic “NTP enabled” label.

Sources

systemd 252 systemd-timesyncd.service, SNTP behavior, large clock steps, saved clock state, and synchronization signals, checked 2026-09-12.
systemd 252 timesyncd.conf, source selection, fallback precedence, polling, and root-distance limits, checked 2026-09-12.
systemd 252 org.freedesktop.timedate1, NTP availability, enablement, and the kernel synchronization property, checked 2026-09-12.
systemd 252 systemd-time-wait-sync.service, ordering dependent services after verified time synchronization, checked 2026-09-12.

Timestamps need explicit time semantics

Sun, 29 Nov 2026 00:00:00 +0000

A wall-clock label such as 2026-11-01 01:30 does not identify one instant by itself. Its interpretation depends on a timezone and sometimes on which occurrence was intended during a clock transition. Conversely, an explicitly defined Unix timestamp already carries epoch and unit semantics without displaying a zone name. Decide which kind of value your system is storing before choosing a format.

An offset is not a timezone rulebook

An offset-bearing timestamp identifies how its civil fields relate to UTC. The strings 12:00Z and 20:00+08:00 on the same date can represent the same instant. A named IANA zone additionally describes historical and future civil-time rules, including daylight-saving changes. An offset of minus seven hours is not a substitute for America/Los_Angeles when scheduling next month’s local appointment.

For events that already happened, retain an unambiguous instant and render it in the reader’s desired zone. A recurring instruction such as nine each business morning needs the local-time intent and applicable zone rules too. Political changes can alter future offsets, so record the relevant timezone data version when reproducibility matters. Converting today’s offset into a permanent schedule silently changes that meaning.

UTC formatting does not prove clock accuracy or causality. Two machines can both print a Z suffix while their clocks disagree. Timestamps with limited precision can also tie. Keep event identifiers and causal context where ordering matters, and use an appropriate monotonic clock for local elapsed intervals. Timezone conversion cannot repair a clock that measured the wrong instant.

Numeric interfaces must document seconds versus milliseconds and the epoch they use. A large integer is not self-describing, and interpreting its unit incorrectly cannot be corrected later by choosing another display timezone.

When it breaks

Sorting arbitrary timestamp strings can disagree with chronological order. RFC 3339 describes conditions under which text sorting works, including consistent timezone representation and fractional precision. Normalize parsed instants before sorting heterogeneous offsets. A visually later local hour can correspond to an earlier UTC instant, so comparing characters is not a replacement for interpreting the timestamp.

The autumn clock transition can repeat a local hour. Python’s ZoneInfo uses fold to distinguish its two occurrences. The spring transition can instead make a local time nonexistent. Attaching a zone object does not automatically reject such a missing time. An application accepting local appointments must define how to reject or resolve these cases rather than silently inventing the user’s intent.

Arithmetic needs equal care. Operations on datetime objects sharing a tzinfo can follow wall-time semantics and ignore the distinction implied by fold. Convert both values to UTC when you intend to compare elapsed instants. Keep that choice explicit: the interval between two appointments measured by local clock labels may differ from actual elapsed seconds across a transition.

Check it quickly

Save the following as timezone.py and run python3 timezone.py with Python 3.11 or newer and IANA timezone data available. The recorded run used Python 3.11.2 and Debian tzdata 2026b. The script uses fixed examples and does not change the machine’s clock or timezone.

from datetime import datetime, timezone
from zoneinfo import ZoneInfo
import json


def instant(text):
 value = datetime.fromisoformat(text)
 if value.tzinfo is None:
 raise ValueError('an instant requires an explicit offset')
 return value.astimezone(timezone.utc)


same = ['2026-09-13T12:00:00Z', '2026-09-13T20:00:00+08:00']
assert instant(same[0]) == instant(same[1])
values = ['2026-01-01T10:00:00+02:00', '2026-01-01T09:30:00+00:00']
assert sorted(values) != sorted(values, key=instant)
try:
 instant('2026-09-13T12:00:00')
except ValueError as error:
 rejection = str(error)
else:
 raise AssertionError('ambiguous instant accepted')

zone = ZoneInfo('America/Los_Angeles')
first = datetime(2026, 11, 1, 1, 30, tzinfo=zone, fold=0)
second = first.replace(fold=1)
first_utc, second_utc = first.astimezone(timezone.utc), second.astimezone(timezone.utc)
assert (second_utc - first_utc).total_seconds() == 3600
missing = datetime(2026, 3, 8, 2, 30)
round_trips = []
for fold in (0, 1):
 candidate = missing.replace(tzinfo=zone, fold=fold)
 returned = candidate.astimezone(timezone.utc).astimezone(zone)
 assert returned.replace(tzinfo=None) != missing
 round_trips.append(returned.isoformat())
print(json.dumps({'same_instant': True, 'lexical_order': sorted(values),
 'instant_order': sorted(values, key=instant), 'naive_rejected': rejection,
 'repeated_wall_time': [first.isoformat(), second.isoformat()],
 'actual_separation_seconds': 3600, 'nonexistent_time_round_trips': round_trips}))

The first assertion shows that two offset representations identify the same instant. Next, lexical sorting puts 09:30+00:00 before 10:00+02:00, while chronological sorting correctly reverses them. The helper rejects a timezone-free value instead of borrowing the host’s current zone. It is a deliberately small instant helper, not a complete RFC 3339 validator.

For Los Angeles on November 1, 2026, the two 01:30 values carry offsets of minus seven and minus eight hours. Converting them to UTC reveals 3,600 elapsed seconds. For March 8 at 02:30, neither fold survives a UTC round trip with the original local fields: the returned times are 03:30 and 01:30. All assertions passed. These examples verify specific transition rules in the installed database; they do not promise that every jurisdiction retains today’s rules forever. Preserve instant meaning, local scheduling intent, and parsing policy as separate parts of the data contract.

Sources

RFC 3339: Date and Time on the Internet, offset-bearing timestamps and conditions for string sorting, checked 2026-09-13.
Python: datetime, aware values, UTC conversion and datetime arithmetic, checked 2026-09-13.
Python: zoneinfo, IANA rules, ambiguous transitions and fold, checked 2026-09-13.

Clock synchronization bounds time disagreement

Wed, 09 Sep 2026 00:00:00 +0000

Clock synchronization reduces disagreement between machines’ civil-time readings. It supports certificate validity checks, timestamp interpretation, and many expiration policies, but it does not establish a perfect global clock. A host can emit well-formatted UTC while measuring the wrong instant. Applications still need to distinguish elapsed durations, absolute deadlines, and causal ordering rather than making them all depend on raw wall-clock comparisons.

Four timestamps estimate two quantities

An NTP exchange records client send time T1, server receive time T2, server transmit time T3, and client receive time T4. The usual offset estimate is ((T2-T1)+(T3-T4))/2; a positive result means the server appears ahead. The round-trip delay estimate is (T4-T1)-(T3-T2), subtracting time spent processing at the server. These are estimates from observations, not direct measurements of every one-way link delay.

If forward and reverse paths have unequal delay, the offset estimate inherits an error. A small round-trip measurement can be useful without proving symmetry. A synchronization daemon uses repeated samples, selection, filtering, and a clock model rather than treating one packet as unquestionable truth. Source reachability, uncertainty, and source trust all matter; a low stratum number alone is not an accuracy certificate.

Timestamp representation also differs from measurement accuracy. A fractional field can encode very fine increments while the underlying clock or network observation remains much less certain. Printing additional decimal places does not improve that evidence.

Clock control is another stage. A daemon can gradually slew corrections, and configured conditions can permit stepping the clock. Do not promise that NTP never produces a wall-clock discontinuity or always reaches sub-millisecond accuracy. The network, oscillator, platform, and configuration determine achievable behavior. Choose monitoring bounds from application needs and measured conditions instead of adopting one universal offset threshold.

When it breaks

A wall clock can move backward or forward, making naive elapsed-time subtraction negative or misleading. Use a suitable monotonic clock for a local duration or timeout. Its reference point is not a portable timestamp for another host or a later boot. Certificate dates and business deadlines still need civil-time semantics, so monotonic time does not replace all timestamp handling.

Malformed, unrelated, unsynchronized, or policy-denied NTP responses must not be accepted as ordinary samples. Matching a response’s origin timestamp to the request helps reject unrelated packets, but it is not cryptographic authentication. Production clients need the protocol’s fuller validation and source-selection behavior. Synchronization also does not turn a timestamp-based lease into a safe distributed lock or guarantee that close events sort in causal order.

Check it quickly

Use a fresh disposable Debian 12 Docker container with Python 3 and chrony installed; the package setup is apt-get update followed by apt-get install -y python3 chrony. Save the code as ntp-exchange.py and run it as root with python3 ntp-exchange.py. The recorded environment used chrony 4.3 and Python 3.11.2. Drop SYS_TIME capability and avoid host networking when creating the container.

from pathlib import Path
from tempfile import TemporaryDirectory
import json
import os
import socket
import struct
import subprocess
import time

assert os.geteuid() == 0 and Path('/.dockerenv').exists(), 'use a disposable root Linux container'
NTP_EPOCH = 2208988800
ERA = 2**32


def stamp(unix_time):
 value = unix_time + NTP_EPOCH
 whole = int(value)
 return struct.pack('!II', whole % ERA, int((value - whole) * ERA))


def seconds(data, reference):
 whole, fraction = struct.unpack('!II', data)
 era = round((reference + NTP_EPOCH - whole) / ERA)
 return whole + era * ERA - NTP_EPOCH + fraction / ERA


def estimate(t1, t2, t3, t4):
 return ((t2 - t1) + (t3 - t4)) / 2, (t4 - t1) - (t3 - t2)


def validate(data, sent):
 if len(data) < 48:
 raise ValueError('short packet')
 if data[0] >> 6 == 3:
 raise ValueError('unsynchronised source')
 if (data[0] & 7) != 4 or ((data[0] >> 3) & 7) != 4:
 raise ValueError('unexpected mode or version')
 if not 1 <= data[1] <= 15:
 raise ValueError('unusable stratum')
 if data[24:32] != sent:
 raise ValueError('origin timestamp mismatch')


with TemporaryDirectory(prefix='ntp-exchange-') as directory:
 root = Path(directory)
 with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as reservation:
 reservation.bind(('127.0.0.1', 0))
 port = reservation.getsockname()[1]
 config = root / 'chrony.conf'
 config.write_text(f'pidfile {root}/pid\ncmdport 0\nbindcmdaddress {root}/command.sock\n'
 f'port {port}\nbindaddress 127.0.0.1\nlocal stratum 8\nallow 127.0.0.1\n')
 process = subprocess.Popen(['chronyd', '-x', '-n', '-u', 'root', '-f', str(config)],
 stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 try:
 deadline = time.monotonic() + 5
 while not (root/'command.sock').exists():
 assert process.poll() is None
 if time.monotonic() > deadline:
 raise AssertionError('chronyd did not start')
 time.sleep(0.05)
 with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as client:
 client.settimeout(5)
 client.connect(('127.0.0.1', port))
 request = bytearray(48)
 request[0] = 0x23
 t1, start = time.time(), time.monotonic()
 sent = stamp(t1)
 request[40:48] = sent
 client.send(request)
 data = client.recv(512)
 t4, finish = time.time(), time.monotonic()
 validate(data, sent)
 t2, t3 = seconds(data[32:40], t1), seconds(data[40:48], t1)
 offset, delay = estimate(t1, t2, t3, t4)
 assert data[1] == 8 and finish >= start
 bad_origin = bytearray(data); bad_origin[24:32] = bytes(8)
 alarm = bytearray(data); alarm[0] |= 0xC0
 denied = bytearray(data); denied[1] = 0
 rejected = []
 for candidate in (data[:40], bad_origin, alarm, denied):
 try:
 validate(candidate, sent)
 except ValueError as error:
 rejected.append(str(error))
 else:
 raise AssertionError('invalid packet accepted')
 symmetric = estimate(100, 105.020, 105.022, 100.042)
 asymmetric = estimate(100, 105.010, 105.012, 100.042)
 assert abs(symmetric[0] - 5) < 1e-9 and abs(symmetric[1] - 0.040) < 1e-9
 assert abs(asymmetric[0] - 4.990) < 1e-9 and abs(asymmetric[1] - 0.040) < 1e-9
 print(json.dumps({'actual_loopback_sample': {'stratum': data[1],
 'offset_seconds': offset, 'delay_seconds': delay,
 'monotonic_elapsed_seconds': finish-start},
 'rejected_packets': rejected,
 'synthetic_symmetric_estimate': list(symmetric),
 'synthetic_asymmetric_estimate': list(asymmetric),
 'known_synthetic_offset': 5,
 'system_clock_adjustment_disabled': True,
 'external_UTC_accuracy_tested': False}))
 finally:
 process.terminate()
 process.communicate(timeout=5)

The fixture starts chronyd with -x, which disables system-clock adjustment, and a loopback-only source using local stratum 8. It sends a real version-four client packet and checks the returned mode, stratum, origin timestamp, and alarm state. Expect a stratum-eight sample with measured offset and delay values that vary between runs. Four altered or truncated packets are rejected. Both sockets and the daemon are closed afterward.

Two separate synthetic calculations hold the true server lead at five seconds. With twenty milliseconds in each direction, the estimate is five seconds and the round-trip network delay forty milliseconds. With ten milliseconds outbound and thirty inbound, the same forty-millisecond delay accompanies an estimated lead of 4.990 seconds. The ten-millisecond error demonstrates the symmetry assumption; those values are not measurements of the loopback path.

All assertions passed. The local source shares the test host’s clock and has no external UTC reference. This experiment neither disciplines that clock nor proves external accuracy, NTS authentication, or full NTP client conformance. Keep the distinction between a valid observed exchange, a bounded estimate, and trustworthy operational time visible in diagnostics.

Sources

RFC 5905: Network Time Protocol Version 4, timestamp exchange, offset estimation and delay, checked 2026-09-13.
chronyd 4.3 manual, clock control and the no-adjustment option, checked 2026-09-13.
Python: time, wall-clock and monotonic-clock behavior, checked 2026-09-13.

Servers need observable time discipline

Wed, 02 Sep 2026 00:00:00 +0000

A time daemon is useful only when its operating state supports the application’s time requirements. A running process can have no usable source, and a selected source can still be wrong or insufficiently measured. Treat time service health as an observable chain: source configuration, successful observations, selection, uncertainty, and permitted clock control. A green process indicator covers only the beginning.

Read what the daemon actually reports

Chrony’s tracking report distinguishes the reference, stratum, last update, remaining system-time correction, estimated frequency, frequency skew, root delay, and root dispersion. These fields answer different questions. Offset concerns time difference; frequency concerns clock rate; skew expresses uncertainty in that frequency estimate. Root delay and dispersion contribute to the uncertainty inherited from the reference path. One small offset does not summarize them all.

The sources report identifies candidates and the selected source. In the usual display, ^* denotes the selected NTP server. Reach is an octal history register, with 377 representing successful responses in the last eight polling opportunities; it is not a percentage or a promise of future availability. LastRx helps reveal how old a received sample is. Read source state alongside tracking rather than interpreting a process uptime counter as synchronization evidence.

A daemon can continue estimating time after an upstream interruption, but uncertainty can grow. Monitor update age and error estimates against the application’s tolerances, and distinguish temporary holdover from indefinitely trustworthy time. Several server names are not necessarily independent references if they share infrastructure. Source selection reduces some failure risks without proving every upstream claim correct.

When it breaks

Containers commonly share the host’s kernel clock. Running a time daemon inside one does not give it an independent civil clock to adjust. Chronyd’s -x option deliberately disables system-clock control while retaining estimation and server operation. A client can therefore report synchronization while the system clock remains uncorrected. Verify the active mode and the layer responsible for host time.

The local directive is another source of misleading confidence. It lets chronyd appear synchronized without an external reference, which can support intentional isolated-network arrangements. Enabling it solely to silence a synchronization alarm hides the missing reference. Check the reference identity and the intended source policy before interpreting Normal as evidence of UTC accuracy.

Operational checks also need meaningful limits. Chronyc waitsync can wait for synchronization and optionally bound remaining correction and frequency skew. Zero limits disable those additional checks. A successful invocation with both limits disabled is weaker evidence than a gate enforcing application-specific tolerances. It still cannot authenticate the correctness of an arbitrary upstream clock.

Check it quickly

Use a fresh disposable Debian 12 Docker container with Python 3 and chrony installed. Prepare packages with apt-get update and apt-get install -y python3 chrony, save this as chrony-status.py, and run python3 chrony-status.py as root. Keep host networking disabled and drop SYS_TIME capability. The recorded run used chrony 4.3 and Python 3.11.2.

from pathlib import Path
from tempfile import TemporaryDirectory
import json
import os
import socket
import subprocess
import time

assert os.geteuid() == 0 and Path('/.dockerenv').exists(), 'use a disposable root Linux container'
with TemporaryDirectory(prefix='chrony-status-') as directory:
 root = Path(directory)
 processes = []
 with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as reservation:
 reservation.bind(('127.0.0.1', 0))
 port = reservation.getsockname()[1]

 def start(name, extra):
 config = root / (name + '.conf')
 config.write_text(f'pidfile {root}/{name}.pid\ncmdport 0\nbindcmdaddress {root}/{name}.sock\n' + extra)
 process = subprocess.Popen(['chronyd', '-x', '-n', '-u', 'root', '-f', str(config)],
 stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 processes.append(process)
 deadline = time.monotonic() + 5
 while not (root/(name+'.sock')).exists():
 assert process.poll() is None, 'chronyd exited before command socket was ready'
 if time.monotonic() > deadline:
 raise AssertionError('command socket not ready')
 time.sleep(0.05)
 return process

 def command(name, *args):
 return subprocess.run(['chronyc', '-n', '-h', str(root/(name+'.sock')), *args],
 capture_output=True, text=True, timeout=10)

 def tracking(name):
 result = command(name, 'tracking')
 assert result.returncode == 0, result.stderr
 return {line.split(':', 1)[0].strip(): line.split(':', 1)[1].strip()
 for line in result.stdout.splitlines() if ':' in line}

 try:
 client = start('client', f'port 0\nserver 127.0.0.1 port {port} iburst minpoll 0 maxpoll 0\n')
 before = tracking('client')
 before_gate = command('client', 'waitsync', '1', '0', '0', '0.1')
 assert client.poll() is None and before['Leap status'] == 'Not synchronised'
 assert before_gate.returncode != 0
 start('source', f'port {port}\nbindaddress 127.0.0.1\nlocal stratum 8\nallow 127.0.0.1\n')
 assert command('client', 'burst', '4/4').returncode == 0
 deadline = time.monotonic() + 25
 while time.monotonic() < deadline:
 sources = command('client', 'sources').stdout
 after = tracking('client')
 if '^* 127.0.0.1' in sources and after['Leap status'] == 'Normal':
 break
 time.sleep(0.2)
 else:
 raise AssertionError('local source was not selected')
 assert after['Stratum'] == '9'
 after_gate = command('client', 'waitsync', '1', '0', '0', '0.1')
 assert after_gate.returncode == 0
 source_tracking = tracking('source')
 assert source_tracking['Reference ID'].startswith('7F7F0101')
 print(json.dumps({'daemon_alive_while_unsynchronised': True,
 'before': before, 'after': after, 'selected_sources': sources,
 'waitsync_returncodes': [before_gate.returncode, after_gate.returncode],
 'source_reference': source_tracking['Reference ID'],
 'system_clock_adjustment_disabled': True,
 'external_UTC_accuracy_tested': False}))
 finally:
 for process in reversed(processes):
 process.terminate()
 process.communicate(timeout=5)

The script first starts a client pointing to an unused loopback port. Its process stays alive, but tracking reports Not synchronised and a one-attempt waitsync gate fails. It then starts a separate local stratum-eight source, requests a burst, and waits for actual selection. The client reports ^* 127.0.0.1, stratum nine, and Normal; the same gate now returns success. Both daemons run with clock adjustment disabled and are terminated afterward.

In the recorded initial selection, frequency skew remained very large even though the synchronization gate passed. The source reference was 7F7F0101, identifying local-reference operation rather than external synchronization. The fixture prints the full observations so these limitations remain visible. All assertions passed, but no external UTC accuracy, long-term convergence, loss-of-source recovery, or actual clock correction was tested. Use this counterexample to separate process availability, synchronization status, quality bounds, and authoritative time in production monitoring.

Sources

chronyc 4.3 manual, tracking fields, source selection and waitsync thresholds, checked 2026-09-13.
chronyd 4.3 manual, clock adjustment and the -x mode, checked 2026-09-13.
chrony.conf 4.3 manual, local-reference mode and source configuration, checked 2026-09-13.
RFC 5905: Network Time Protocol Version 4, synchronization state and uncertainty, checked 2026-09-13.

Time · XB Field Notes

NOW and clock_timestamp differ by when they freeze

A transaction has one start time

Statement markers and live readings

When it breaks

Check it quickly

Sources

Check timesyncd’s service state and clock evidence separately

When it breaks

Check it quickly

Build a time requirement that can be verified

Further reading

Sources

Timestamps need explicit time semantics

An offset is not a timezone rulebook

When it breaks

Check it quickly

Sources

Clock synchronization bounds time disagreement

Four timestamps estimate two quantities

When it breaks

Check it quickly

Sources

Servers need observable time discipline

Read what the daemon actually reports

When it breaks

Check it quickly

Further reading

Sources