16.1 Configure Time Service Clients

16.1 Configure Time Service Clients

Quick Answer: Check state with timedatectl status. Set the zone with timedatectl set-timezone America/New_York (use a real zone from timedatectl list-timezones). Turn on network time with timedatectl set-ntp true, which relies on chronyd. Confirm sync with timedatectl, systemctl status chronyd, and chronyc tracking / chronyc sources.

Why time is a deploy objective

Under Deploy, configure, and maintain systems, Red Hat expects you to configure time service clients. Wrong time breaks TLS, Kerberos, log correlation, scheduled jobs, and certificate validity windows. EX200-style tasks look like:

• “Set the system timezone to Europe/Berlin.”
• “Ensure the system synchronizes time via NTP/chrony.”
• “Configure chrony to use server ntp.example.lab and enable the service.”
• “Make sure time stays correct after reboot.”

You are graded on persistent configuration and demonstrable sync state, not on memorizing every chrony filter directive.

timedatectl: the front door

systemd-timedated exposes timedatectl. Use it first on every time task.

timedatectl
# or
timedatectl status

Typical fields you care about:

timedatectl show
timedatectl show-timesync 2>/dev/null || true

Set timezone

timedatectl list-timezones | less
timedatectl list-timezones | grep -i chicago
sudo timedatectl set-timezone America/Chicago
timedatectl
date
ls -l /etc/localtime
# /etc/localtime -> ../usr/share/zoneinfo/America/Chicago

Rules:

• Use IANA names (Region/City), not legacy CST6CDT strings unless a task forces them.
• set-timezone updates /etc/localtime (symlink into /usr/share/zoneinfo/).
• Wrong spelling fails—tab-complete via list-timezones or grep.

# Common exam zones (examples only—use what the task names)
sudo timedatectl set-timezone UTC
sudo timedatectl set-timezone America/New_York
sudo timedatectl set-timezone Europe/London
sudo timedatectl set-timezone Asia/Tokyo

Enable or disable NTP (network time)

sudo timedatectl set-ntp true
timedatectl | grep -E 'NTP|synchronized'
systemctl is-active chronyd
systemctl is-enabled chronyd

sudo timedatectl set-ntp false   # only when you must freeze NTP (rare on exam)

On RHEL, set-ntp true enables and starts the configured time sync service—almost always chronyd (package chrony). If chrony is missing on a minimal image:

rpm -q chrony
sudo dnf install -y chrony
sudo systemctl enable --now chronyd
sudo timedatectl set-ntp true

Exam habit: After set-ntp true, always prove chronyd is active and enabled and that timedatectl shows NTP active (and ideally synchronized after sources answer).

Manual time set (when allowed)

If the task says set the clock to a specific value and NTP is off or unreachable:

sudo timedatectl set-ntp false
sudo timedatectl set-time '2026-08-05 14:30:00'
timedatectl
date

Format is typically YYYY-MM-DD HH:MM:SS. With NTP on, manual sets may be refused or quickly overwritten—disable NTP first if you must set manually, then re-enable if the lasting requirement is sync.

RTC and hwclock (awareness)

sudo hwclock --show
# timedatectl can set RTC from system time depending on options/docs
timedatectl | grep RTC

Prefer RTC in UTC (default). Do not casually switch “RTC in local TZ” unless a task demands it—timezone + NTP correctness is the usual bar.

chronyd: the time client daemon

Service control

systemctl status chronyd -l --no-pager
sudo systemctl enable --now chronyd
systemctl is-active chronyd
systemctl is-enabled chronyd

Unit name is chronyd. Logs:

sudo journalctl -u chronyd -b --no-pager | tail -n 40

Configuration file

Primary config: /etc/chrony.conf (and sometimes drop-ins under /etc/chrony.d/ on newer layouts—check what the system uses).

grep -E '^(server|pool|peer|sourcedir)' /etc/chrony.conf
ls /etc/chrony.d 2>/dev/null

Common directives:

Exam pattern—use a lab NTP server:

sudo cp -a /etc/chrony.conf /etc/chrony.conf.bak
sudo vim /etc/chrony.conf

Example fragment (follow task hostnames):

# Prefer task-specified servers; comment or remove conflicting defaults if required
server ntp.example.lab iburst
# pool 2.rhel.pool.ntp.org iburst

sudo systemctl restart chronyd
chronyc -a makestep 2>/dev/null || sudo chronyc makestep

After edits: restart chronyd, then verify sources. Some environments use sourcedir /run/chrony-dhcp or NetworkManager-provided sources—if the task gives an explicit server, put it in config and ensure it shows in chronyc sources.

chronyc verification (client tools)

chronyc tracking
chronyc sources -v
chronyc sourcestats
chronyc activity

Interpret:

• tracking: Reference ID, stratum, system time offset, leap status.
• sources: ^* = current sync source; ^+ = acceptable candidate; ^? = unreachable/unusable; ^x = false ticker.

# Quick health
chronyc tracking | grep -E 'Reference|System time|Leap'
chronyc sources | head

If all sources are ^?, fix network, DNS, firewall (UDP/123), or the server line in chrony.conf. Time sync is a client config skill—also ensure the host can reach the NTP server.

Firewall note

Outbound NTP usually works without opening inbound ports. If you run chronyd as a server for others (less common on EX200 “client” wording), you would allow UDP 123 in firewalld. Client-only tasks focus on config + service enablement.

Relationship: timedatectl vs chronyc vs date

Do not stop at date alone—graders and self-checks want timezone + NTP service + sync evidence.

Full exam workflows

Workflow A — Timezone only

timedatectl list-timezones | grep Berlin
sudo timedatectl set-timezone Europe/Berlin
timedatectl | grep 'Time zone'
date

Workflow B — Enable network time (standard)

rpm -q chrony || sudo dnf install -y chrony
sudo systemctl enable --now chronyd
sudo timedatectl set-ntp true
timedatectl
chronyc sources -v
chronyc tracking

Workflow C — Point chrony at a lab server

sudo sed -i.bak '/^pool /s/^/#/' /etc/chrony.conf   # optional: quiet default pools if task wants exclusive server
echo 'server ntp.classroom.example iburst' | sudo tee -a /etc/chrony.conf
sudo systemctl restart chronyd
sleep 2
chronyc sources -v
sudo timedatectl set-ntp true
timedatectl

Prefer clean, readable chrony.conf edits over blind sed if you have time—end state is what matters.

Workflow D — Prove persistence

systemctl is-enabled chronyd
timedatectl
sudo systemctl reboot
# after login:
timedatectl
systemctl is-active chronyd
chronyc tracking

Common traps

1. Setting timezone with a wrong name (US/Eastern may work on some systems; prefer the task’s exact string from list-timezones).
2. set-ntp true without chrony installed—install chrony first.
3. Editing chrony.conf but never restarting chronyd.
4. Assuming date is enough—not proof of NTP client configuration.
5. Leaving NTP disabled after a manual set-time when the task wanted ongoing sync.
6. Firewall or offline lab with unreachable public pools—use the local server the exam provides.
7. Confusing hardware clock skew with failed NTP—check chronyc sources for ^?.
8. Stopping chronyd to “fix” time for a script while forgetting to re-enable.
9. Only systemctl start chronyd without enable—fails after reboot.
10. Editing the wrong file (legacy ntp.conf for ntpd)—RHEL client path is chrony.

Relationship to other chapters

• Scheduling (15.1): cron/timers fire on local time—wrong zone means wrong wall-clock schedules.
• Logs (Ch10): journal timestamps follow the clock; skew confuses incident review.
• Services (15.2): enable --now chronyd is the same persistence model as other daemons.
• Networking: DNS and reachability to NTP servers matter for sources health.

Section checkpoint

You should query and set timezone with timedatectl, enable NTP via set-ntp true, ensure chronyd is installed, active, and enabled, configure server/pool lines in /etc/chrony.conf when required, verify with chronyc tracking and sources, use manual set-time only when appropriate, and leave a configuration that still looks correct after reboot. That is the EX200 bar for time service clients on RHEL 10.