CHRONYD(8)

📦
version 4.9 · 13 versions
, in centos-stream 10, centos-stream 9, fedora 44

💖 CHRONYD(8) — the system administration girlies' edition 💖

okay bestie, sit down, hydrate, because we're about to talk about chronyd — the chrony daemon itself. section 8, system administration, she's that girl. 👑

🌸 NAME 🌸

chronyd — literally just, the chrony daemon. that's her. that's the whole name. iconic.

✨ SYNOPSIS ✨

chronyd [OPTION]... [DIRECTIVE]...

that's it. that's the summoning ritual. 🕯️

🦋 DESCRIPTION 🦋

so chronyd is a daemon for synchronisation of the system clock. and no, she doesn't just do one thing, she does everything:

  • she can sync your clock with NTP servers 🌐
  • she can sync with reference clocks (think a GPS receiver, very main character energy 📡)
  • she can sync with manual input — like, from a wristwatch ⌚ and a keyboard ⌨️, via chronyc
  • and she can also operate as an NTPv4 (RFC 5905) server and peer, so she can hand out a time service to all the other computers in the network like the generous queen she is 👑

if you don't pass any configuration directives on the command line, chronyd will just read them from a configuration file instead. the compiled-in default location of that file is /etc/chrony.conf. 🎀

and where do the messages go? informational messages, warnings, and errors all get logged to syslog. periodt. 💅

💅 OPTIONS 💅

every single flag, in order, no skips, because we don't leave girls behind:

  • -4 — with this one, hostnames get resolved to IPv4 addresses only, and only IPv4 sockets get created. v4 girlies only, sorry.
  • -6 — same energy, opposite direction: hostnames resolve to IPv6 addresses only and only IPv6 sockets get created. ✨
  • -f file — use this to point at an alternate location for the configuration file. the compiled-in default value is /etc/chrony.conf. 🗂️
  • -n — in this mode the program will not detach itself from the terminal. she stays attached. clingy in the best way. 🫶
  • -d — same as not detaching from the terminal, but also all messages get written to the terminal instead of syslog. and if chronyd was compiled with enabled support for debugging, you can pass this option twice to enable debug messages. two times the -d, two times the chaos. 🐛
  • -l file — enables writing of log messages to a file, instead of syslog or the terminal. 📝
  • -L level — sets the minimum severity level of messages written to the log file, syslog, or terminal. the levels you can specify are: -1 (debug, only if compiled with enabled support for debugging), 0 (informational), 1 (warning), 2 (non-fatal error), and 3 (fatal error). default value is 0. 🚦
  • -p — in this mode chronyd will print the configuration and exit. she will not detach from the terminal. super handy for verifying the syntax of your config and getting the whole configuration, even when it's split into multiple files and read by the include or confdir directive. like a config reveal, slay. 📜
  • -q — in this mode chronyd will set the system clock once and exit. will not detach from the terminal. one and done. 💫
  • -Q — similar to -q, except it only prints the offset without making any corrections of the clock, and it disables server ports so chronyd can be started without root privileges — assuming your configuration doesn't have any directives that would require them (e.g. refclock, hwtimestamp, rtcfile, etc). look but don't touch. 👀
  • -r — tries to reload and then delete files containing sample histories for each of the servers and reference clocks being used. those files are expected to be in the directory specified by the dumpdir directive in the configuration file. useful if you wanna stop and restart chronyd briefly for any reason, e.g. to install a new version. however — and this is a big however — it should be used only on systems where the kernel can maintain clock compensation whilst not under chronyd's control (i.e. Linux, FreeBSD, NetBSD, OpenBSD, illumos, and macOS 10.13 or later). read that twice bestie. 👑
  • -R — when used, the initstepslew directive and the makestep directive used with a positive limit will be ignored. useful when restarting chronyd, and it can be used together with the -r option. besties fr fr. 🤝
  • -s — sets the system clock from the computer's real-time clock (RTC), or to the last modification time of the file specified by the driftfile directive. real-time clocks are supported only on Linux. 🐧

if used together with the -r flag, chronyd will attempt to preserve the old samples after setting the system clock from the RTC. this can be used to let chronyd perform long term averaging of the gain or loss rate across system reboots, and it's useful for systems with intermittent access to network that are shut down when not in use. for this to work well, it relies on chronyd having been able to determine accurate statistics for the difference between the RTC and system clock the last time the computer was on. 📊

and if the last modification time of the drift file is later than both the current time and the RTC time, the system time will be set to it, to restore the time when chronyd was previously stopped. useful on computers that have no RTC, or where the RTC is broken (e.g. it has no battery). RIP to that CMOS battery 🪦

  • -t timeout — sets a timeout (in seconds) after which chronyd will exit. if the clock is not synchronised, it will exit with a non-zero status. useful with -q or -Q to shorten the maximum time waiting for measurements, or with -r to limit the time when chronyd is running, but still allow it to adjust the frequency of the system clock. ⏰
  • -u user — sets the name of the system user to which chronyd will switch after start, in order to drop root privileges. it overrides the user directive. the compiled-in default value is chrony. 🙇

on Linux, chronyd needs to be compiled with support for the libcap library. on macOS, FreeBSD, NetBSD, OpenBSD, and illumos, chronyd forks into two processes. the child process retains root privileges, but can only perform a very limited range of privileged system calls on behalf of the parent. 🍼

  • -U — disables a check for root privileges, so chronyd can be started under a non-root user — assuming the process will have all capabilities (e.g. provided by the service manager) and access to all files, directories, and devices needed to operate correctly in the specified configuration. note that different capabilities might be needed with different configurations and different Linux kernel versions.
⚠️ starting chronyd under a non-root user is not recommended when the configuration is not known, or at least limited to specific directives. be careful bestie, this is the risky one 😭
  • -F level — configures system call filters loaded by chronyd processes, if it was compiled with support for the Linux secure computing (seccomp) facility or OpenBSD pledge. for Linux three levels are defined: 0, 1, 2; for OpenBSD two levels: 0, 1. the filters are disabled at level 0. on Linux at levels 1 and 2, and on OpenBSD at level 1, chronyd will be killed if it makes a system call which is blocked by the filters. 💀 on Linux the level can be specified as a negative number to trigger the SIGSYS signal instead of SIGKILL, which can be useful for debugging. the default value is 0.

on Linux at level 1, the filters allow only selected system calls that are normally expected to be made by chronyd. other system calls are blocked. this level is recommended only if it is known to work on the version of the system where chrony is installed. the filters need to allow also system calls made by libraries that chronyd is using (e.g. libc), but different versions or implementations of the libraries might make different system calls. if the filters are missing a system call, chronyd could be killed even in normal operation. 😭 that's the whole tea.

at level 2, the filters block only a small number of specific system calls (e.g. fork and exec). this approach should avoid false positives, but the protection of the system against a compromised chronyd process is much more limited. 🛡️

🚫 the filters cannot be enabled with the mailonchange directive. no exceptions, periodt.
  • -P priority — on Linux, FreeBSD, NetBSD, OpenBSD, and illumos this option selects the SCHED_FIFO real-time scheduler at the specified priority (which must be between 0 and 100). on macOS, this option must have either a value of 0 to disable the thread time constraint policy, or 1 for the policy to be enabled. other systems do not support this option. the default value is 0. 🎚️
  • -m — locks chronyd into RAM so she will never be paged out. this mode is only supported on Linux, FreeBSD, NetBSD, OpenBSD, and illumos. she stays resident, she stays ready. 🔒
  • -x — disables the control of the system clock. chronyd will not try to make any adjustments of the clock. it will assume the clock is free running and still track its offset and frequency relative to the estimated true time. this lets chronyd be started without the capability to adjust or set the system clock (e.g. in some containers) to operate as an NTP server. ✋🕐
  • -N fd — specifies a file descriptor that chronyd will write a newline to after it is fully initialised. this is to notify a service supervisor that chronyd is in a ready state. when using this option, you should also specify that this is a non-forking service by using either the -n or -d option. 📣
  • -v, --version — prints the version number to the terminal and exits. 🏷️
  • -h, --help — prints a help message to the terminal and exits. 🆘

🌈 ENVIRONMENT VARIABLES 🌈

  • LISTEN_FDS — on Linux systems, the systemd service manager may pass file descriptors for pre-initialised sockets to chronyd. the service manager allocates and binds the file descriptors, and passes a copy to each spawned instance of the service. this allows for zero-downtime service restarts as the sockets buffer client requests until the service is able to handle them. the service manager sets the LISTEN_FDS environment variable to the number of passed file descriptors. 🔁✨
  • NOTIFY_SOCKET — the systemd service manager sets this variable for services of the notify type. chronyd sends a message to this socket when it is fully initialised and ready to accept commands (e.g. from chronyc), with the clock already set if using the -s option or initstepslew directive. it's an alternative to the forking service type, which does not need the PID file. chronyd needs to be started with the -n or -d option to not fork. 📨

🎀 FILES 🎀

  • /etc/chrony.conf

👀 SEE ALSO 👀

go read those too, they're required reading for the girlies. 💜

💀 BUGS 💀

for instructions on how to report bugs, please visit https://chrony-project.org/. yes, actually tell them. they want to know. constructive feedback is self care. 🫶

👑 AUTHORS 👑

chrony was written by Richard Curnow, Miroslav Lichvar, and others. legends, honestly. 🙌

okay that's the whole page, you made it to the end, I'm so proud of you 🥹 this was chrony 4.9, dated 2026-08-27, and it lives in section 8 of the manual — go forth and sync those clocks bestie, no cap, fr fr, periodt 💖✨🦋🌸💅

📦 where this page comes from