A VPS clock that drifts by even a few seconds causes failures that look completely unrelated: TLS certificates suddenly rejected as “not yet valid,” cron jobs that fire at the wrong time, log entries that arrive out of order during an incident, and rate-limiters that trip for no apparent reason. Virtual machines are especially prone to drift because they have no direct access to a hardware clock — they depend entirely on the hypervisor’s timekeeping, which degrades under host load. This article explains how to measure the drift, why it breaks TLS and automation, and how to set up chrony (including authenticated time with NTS) so your server’s clock stays trustworthy.<\/p>\n\n\n\n
A physical server has a battery-backed RTC (real-time clock) and keeps time with hardware interrupts. A VM has neither: the guest kernel reads time from the hypervisor (kvm-clock, Xen, or Hyper-V time source), and that source is only as accurate as the host’s scheduling. When the host is busy, timer interrupts to your guest are delayed, and the guest clock accumulates error. On a loaded neighbour’s host, drift of tens of milliseconds per hour — up to a second or more per day — is routine. Most VPS images install a time-sync daemon, but many minimal images and Docker-optimized templates do not, which is how a server quietly ends up minutes off without anyone noticing.<\/p>\n\n\n\n
Before changing anything, establish the baseline:<\/p>\n\n\n\n
timedatectl\ntimedatectl timesync-status\nchronyc tracking # if chrony is installed<\/code><\/pre>\n\n\n\ntimedatectl<\/code> shows whether NTP sync is active and what the current offset is. An offset above 50 ms on an idle server is already a sign of poor timekeeping; above a second means something is actively broken (wrong timezone, sync daemon not running, or blocked UDP 123 egress). If NTP sync is off entirely, that is your answer — the clock has been drifting since boot.<\/p>\n\n\n\nchrony vs systemd-timesyncd vs ntpd<\/h2>\n\n\n\n
Three daemons dominate Linux time sync. All three can keep a VPS within milliseconds of UTC, but they differ in fit:<\/p>\n\n\n\n