Fix clock drift and time sync problems in KVM virtual machines

Wrong time on a server breaks TLS certificates, 2FA codes, log correlation, cron schedules and distributed databases. Virtual machines are more prone to clock drift because they share CPU time and can be paused, snapshotted or migrated. This guide shows how to keep VM time accurate.

Before you start

• Root on the guest; host access only for the optional host-side settings.
• General NTP background: time sync with NTP and chrony.

Why VMs drift

• Guests do not get CPU time continuously, so timer interrupts can be delayed.
• Pausing, saving/restoring snapshots or migrating can leave the guest clock behind.
• Old guests may use clock sources that behave poorly under virtualization.

Check the clock source (Linux)

cat /sys/devices/system/clocksource/clocksource0/current_clocksource

On KVM it should be kvm-clock, a paravirtual clock that tracks host time well. If not, check that the guest kernel has KVM guest support.

Run an NTP client in every guest

chrony handles virtual environments well:

sudo apt install -y chrony

In /etc/chrony/chrony.conf (or /etc/chrony.conf) make sure large initial offsets are corrected by stepping:

makestep 1.0 3

sudo systemctl enable --now chrony

Check sync status:

chronyc tracking

systemd-timesyncd is also fine for simple servers: timedatectl set-ntp true.

After suspend, restore or migration

• chrony with makestep corrects large jumps quickly.
• The QEMU guest agent can set the guest clock from the host after resume (virsh domtime vmname --sync).
• Proxmox and libvirt can trigger this automatically when the agent is enabled; see QEMU guest agent.

Windows guests

• Enable Hyper-V enlightenments with the Hyper-V clock on the host; see Windows on KVM tuning.
• Configure Windows Time to sync with reliable NTP servers if not domain-joined:

w32tm /config /manualpeerlist:"pool.ntp.org" /syncfromflags:manual /update

w32tm /resync

Domain members should sync from domain controllers instead.

Host side (for admins)

• Keep the hosts themselves synced with NTP.
• Use <clock offset='utc'> for Linux guests and localtime only for Windows guests that expect it.

Troubleshooting

• Time jumps back and forth: two sync services running (e.g. chrony and timesyncd); keep one.
• chronyc shows no sources: outbound UDP 123 blocked by a firewall.
• Container VPS cannot change time: OpenVZ/LXC guests use the host clock; ask the provider.

Frequently asked questions

Should I set the timezone to UTC?

Many admins keep servers on UTC for simpler logs; the clock accuracy issue is separate from timezone. See hostname and timezone setup.

How accurate should a server be?

Within milliseconds is easy with chrony; certificates and 2FA tolerate small offsets but not minutes.

Does the guest agent replace NTP?

No, use both: NTP for continuous accuracy, the agent for fast correction after pauses.

Next steps

• NTP and chrony
• QEMU guest agent
• KVM live migration