NTP Offset Log Checker

NTP or chrony rows:

Paste one peer table or CSV extract with offset and jitter/error evidence. Values without units are treated as milliseconds.

{{ fileStatus || 'Drop NTP, chrony, CSV, TXT, or LOG output onto the textarea.' }}

Offset gate:

Use a strict single-digit gate for precise time-sensitive services, or a larger gate for branch infrastructure triage.

Jitter/error gate:

This catches variable or uncertain peers even when the instantaneous offset is small.

Maximum stratum:

Keep this aligned with the tier expected for the device or site being checked.

stratum

Selection policy:

Use warning mode for peer-table checks; choose Ignore when analyzing exported CSV rows without source markers.

NTP source input needs attention

{{ error }}

Visible peer limit:

Raise this only when reviewing a large estate export.

peers

Metric	Value	Interpretation	Copy
{{ row.metric }}	{{ row.value }}	{{ row.note }}

Peer	Offset	Jitter/error	Stratum	Reach	Source state	Status	Parser	Copy
{{ row.peer }}	{{ row.offsetDisplay }}	{{ row.jitterDisplay }}	{{ row.stratumDisplay }}	{{ row.reachDisplay }}	{{ row.sourceState }}	{{ row.status }}	{{ row.format }}

Finding	Severity	Evidence	Suggested next check	Copy
{{ row.finding }}	{{ row.severity }}	{{ row.evidence }}	{{ row.nextCheck }}

Embed:

Customize

Include current inputs

Size

Advanced

Width

Height

Aspect ratio

Max height

Collapsible embed

Allow fullscreen

Referrer policy

Sandbox tokens

A host can have a running time service and still be poor evidence for production time. The useful question is not only whether NTP or chrony is active, but whether the current peers are reachable, selected, close enough to the local clock, and stable enough for the job that host performs. Kerberos tickets, TLS validation, database replication, log correlation, certificate rotation, and incident timelines can all become harder to trust when a clock quietly drifts outside the tolerance expected for that environment.

Peer output is a compact diagnostic view of that trust decision. Offset is the estimated distance between a peer and the local clock. Jitter, error, or standard deviation shows how noisy or uncertain that estimate is. Reach records recent polling success. Stratum shows how far a source is from a reference clock, and source markers show whether the daemon selected, combined, rejected, or could not use a source.

NTP peer evidence terms and operational meaning
Evidence	Plain meaning	Why it matters
Offset	How far the peer appears from the local clock.	A large positive or negative value can break time-sensitive authentication, ordering, and logs.
Jitter or error	How much the timing estimate varies or how wide the error margin is.	A source with a small offset but high uncertainty can still be a weak choice.
Reach	An octal record of recent successful polls.	Incomplete reach can expose packet loss, filtering, DNS changes, or a source that only recently recovered.
Stratum	The source distance from a reference clock.	Unexpectedly high stratum can point to the wrong upstream tier or an unsynchronized source.
Source marker	The daemon's selection clue, such as selected, candidate, variable, or unreachable.	The best-looking timing number is less useful when the daemon did not actually select that peer.

Different command families expose these clues with slightly different vocabulary. A classic ntpq -pn peer table prints offset and jitter in milliseconds. chronyc sources prints a last-sample offset plus a +/- error margin, while chronyc sourcestats prints offset and sample standard deviation. Those values are related operational evidence, but they should not be treated as identical measurements.

NTP peer evidence plotted by offset and jitter with reach history noted.

A clean peer table is still a point-in-time clue. It cannot prove that the upstream source is correct, that the next poll will succeed, or that a virtual machine will keep the same timing behavior after migration. Treat peer evidence as an operational review of recent daemon output, then confirm with the host's full time-service status when the decision is important.

How to Use This Tool:

Use the checker when you have copied peer output or a small export and need a consistent review of timing drift, reachability, and source selection.

Paste ntpq -pn, chronyc sources, chronyc sourcestats, CSV, or plain peer rows into NTP or chrony rows. You can also use Browse or drag in a TXT, LOG, or CSV file under 1 MB.
Use ntpq sample or chrony sample when you want to see the expected shape before pasting real output. Use Normalize after copying from a terminal, ticket, or email thread.
Set Offset gate in milliseconds for the drift you want to review. Keep 50 ms for a broad infrastructure pass, or lower it for authentication, databases, observability, or forensic timelines that need tighter clocks.
Set Jitter/error gate for noisy or uncertain peers. For ntpq rows this reviews jitter, for chronyc sources it reviews the +/- error margin, and for chronyc sourcestats it reviews Std Dev.
Choose the Maximum stratum expected for the host or site, then set Selection policy. Use warning mode when source markers such as * or o are present, and use ignore mode for CSV extracts that never carried those markers.
Start with Sync Snapshot, then inspect Peer Ledger and Drift Findings. The summary should show a parsed peer count, the flagged count, the worst jitter/error peer, selected-source evidence, and the gate values.
If the page reports NTP Source Needs Input or No peer rows parsed, check that each non-header row includes a peer name plus offset and jitter/error values. Convert difficult exports to a simple peer, offset, jitter/error, stratum CSV shape before retrying.

Interpreting Results:

The headline offset uses the largest absolute offset among parsed peers, so a negative drift and a positive drift are treated with the same seriousness. Do not stop at that number. A peer with a small offset can still be weak evidence if reach is 0, the source marker is unusable, stratum is unsynchronized, or no selected source appears in marker-aware output.

NTP result states and follow-up actions
Result cue	Meaning	Follow-up
NTP Sources In Gate	Parsed peers stayed within the current offset, jitter/error, stratum, reach, and source-state checks.	Save the source rows with the gate values if the result supports a maintenance record.
NTP Source Review	At least one warning finding exists, often from a crossed gate, incomplete reach, source variability, or skipped lines.	Open Drift Findings and fix the most specific evidence first.
Time Drift Risk	High or Critical evidence exists, such as reach `0`, no selected source, a falseticker marker, severe offset, or stratum `16`.	Do not rely on that host as timing evidence until the daemon status and upstream path have been checked.
Source lines skipped	Some non-empty lines did not match supported NTP, chrony, CSV, or plain-row patterns.	Normalize the paste or provide CSV columns for peer, offset, jitter/error, stratum, marker, reach, and delay where available.

Use the Offset Jitter Map to separate one distant outlier from a generally noisy peer set. A point inside the offset gate but above the jitter/error gate deserves attention because it may be close right now but unstable enough to become a poor source later.

Technical Details:

NTP and chrony daemons estimate time from repeated exchanges with upstream sources, then expose a reduced peer view for operators. The review starts from those daemon-reported values. It does not recompute packet timestamps, discipline the clock, or decide whether an upstream source is truly correct. It evaluates the supplied rows for drift, uncertainty, reachability, stratum policy, and source-selection evidence.

Milliseconds are the working unit for timing checks. Values with ns, us, ms, or s suffixes are normalized to milliseconds, and values without a unit are treated as milliseconds. That keeps ntpq, chrony, CSV, and plain rows comparable enough for a review pass while preserving the source family label in the ledger.

Formula Core

The displayed offset headline is the largest absolute peer offset. The sign still matters in the ledger, but the summary uses magnitude because either direction can break time-sensitive systems.

O = \max (| {offset}_{i} |)

For peers at -0.743 ms, 1.214 ms, and 64.800 ms, the headline offset is 64.800 ms. The peer ledger still shows the original signed values so you can see which clocks are ahead or behind.

Rule Core

NTP offset log checks and severity boundaries
Check	Boundary	Severity
Offset	`\|offset_ms\| > offset gate`	Warning, or High when the value is at least four times the gate or at least `1000 ms`.
Jitter or error	`jitter_or_error_ms > jitter/error gate`	Warning, or High when the value is at least three times the gate.
Stratum	`stratum > maximum stratum`, and `stratum >= 16`	Warning above the chosen ceiling; Critical at unsynchronized stratum.
Source marker	`*` or `o` selected; `x` or `?` unusable; `~` too variable.	Clear for selected, High for unusable, Warning for variable.
Reach	Octal reach `0`, or any octal reach other than `377`.	High at `0`; Warning for incomplete recent-poll history.
Selected source	Marker-aware rows exist in warning mode and none are selected with `*` or `o`.	High.

Offset and jitter/error gates use strict greater-than checks. A value exactly equal to the gate remains inside the gate. Stratum 16 and above is treated as unsynchronized because NTP practice uses that boundary as the maximum stratum number rather than a normal upstream tier.

Source Format Semantics

Supported source formats and timing fields
Input family	Timing fields used	Selection evidence
`ntpq` peers	`offset`, `jitter`, `delay`, `st`, and `reach`.	The leading tally character identifies selected, candidate, falseticker, variable, or unreachable states.
`chronyc sources`	Last-sample offset and the `+/-` error margin.	The two-character mode/state marker includes selected, combined, rejected, variable, and unreachable states.
`chronyc sourcestats`	Offset and `Std Dev` from the source statistics report.	No selected-source marker is normally present in the parsed rows.
CSV or plain rows	Peer, offset, jitter/error, stratum, marker, reach, and delay when supplied.	Marker and reach checks run only when those fields are present.

The rule path is intentionally conservative. A peer can collect several findings at once: for example, 64.800 ms offset, 23.900 ms jitter, stratum 4, and reach 177 crosses the default offset gate, crosses the default jitter/error gate, and reports incomplete recent reach. The ledger status becomes the worst severity on that peer, while Drift Findings keeps each reason separate so the next check is specific.

Privacy and Accuracy Notes:

The pasted text and loaded files are reviewed in the browser. Hostnames, IP addresses, pool names, branch labels, and internal time-source names can still be sensitive when copied into screenshots, CSV files, DOCX exports, JSON, tickets, or chat messages.

Files larger than 1 MB are rejected, so large estate exports should be trimmed before review.
A clean result describes only the rows supplied. It does not prove the daemon remained synchronized before or after the pasted sample.
Clock behavior can change after daemon restart, VM migration, firewall changes, DNS changes, upstream pool movement, packet loss, or leap-state changes.
Use the same gates when comparing multiple hosts, otherwise the flagged count may reflect policy changes rather than clock behavior.

Advanced Tips:

Keep Selection policy in warning mode for live ntpq and chronyc sources output so missing * or o evidence is not hidden by otherwise small offsets.
Use Ignore selected-source markers only for CSV or plain-row exports that never carried source-state markers; otherwise the selected-source check is part of the health signal.
Set Offset gate and Jitter/error gate before comparing sites. The Drift Findings rows quote the active gates, so saved evidence stays tied to the policy used for that run.
Lower Visible peer limit for quick ticket review and raise it for estate exports; JSON and CSV exports still carry the parsed peer evidence needed for follow-up.
Read the Offset Jitter Map after the ledger when several peers are flagged. Selected points have a stronger outline, making it easier to separate the daemon's chosen source from nearby candidates and outliers.

Worked Examples:

Branch peer outside the default gates

An ntpq -pn row for branch-rtr.local shows 64.800 ms offset, 23.900 ms jitter, stratum 4, and reach 177. With the default 50 ms offset gate and 20 ms jitter/error gate, Sync Snapshot reports 64.80 ms as the headline offset, Peer Ledger marks that peer as Warning, and Drift Findings lists offset, jitter/error, and incomplete reach.

Value exactly on a gate

A CSV row with offset_ms set to 50.0, jitter_ms set to 20.0, stratum 3, marker *, and reach 377 stays inside the default gates. The strict > boundary means Drift Findings can show All parsed peers are inside gates instead of flagging a value that only equals the threshold.

Chrony source with no selected marker

A pasted chronyc sources sample contains ^+ and ^- rows but no ^* row. In warning selection policy, Drift Findings adds No selected time source, even if the offsets are small. Re-run chronyc sources on the host and check why chronyd has not selected a best source before using the host as a time reference.

Copied output that will not parse

A ticket paste includes command prompts, separators, and wrapped table rows, so the summary shows NTP Source Needs Input or Source lines skipped. Use Normalize, remove prompts and explanatory lines, or paste CSV with peer, offset, jitter/error, and stratum values. When parsing succeeds, Sync Snapshot shows the parsed peer count and the skipped-line count drops.

FAQ:

Does a small offset prove the clock is healthy?

No. Check Peer Ledger for reach, stratum, source marker, and jitter/error. A small offset with reach 0 or no selected source is weak timing evidence.

Why does chrony error count as jitter/error?

chronyc sources reports a last-sample offset and a +/- error margin, not the same jitter value printed by ntpq. The checker treats it as the operational uncertainty value for that row.

What should I do when rows are skipped?

Remove shell prompts, wrapped headers, and unrelated log lines, then use Normalize. If the output is still irregular, paste CSV rows with peer, offset, jitter/error, stratum, marker, reach, and delay columns where available.

When should selected-source warnings be ignored?

Use Ignore selected-source markers for CSV or plain-row extracts that never included *, o, or chrony source-state markers. Keep warning mode for live peer tables.

Can I compare several hosts with one result?

Yes, but use the same Offset gate, Jitter/error gate, Maximum stratum, and source format for each run. Mixed gates or mixed command families can make flagged counts look inconsistent.

Glossary:

Offset: The estimated time difference between the local clock and a peer or source.
Jitter: Variation in timing estimates, commonly printed by ntpq peer output.
Error margin: The uncertainty value shown after +/- in chronyc sources output.
Reach: An octal record of recent polling success; 377 means the recent register is full in common peer views.
Stratum: The source distance from a reference clock; stratum 16 indicates an unsynchronized source in NTP practice.
Selected source: The peer currently chosen for synchronization, usually marked with * or o.
Falseticker: A source marked as inconsistent with trusted or majority time evidence.

References:

RFC 5905: Network Time Protocol Version 4, IETF, June 2010.
chronyc(1) Manual Page, chrony project, August 25, 2025.
ntpq - standard NTP query program, Network Time Foundation, March 27, 2023.
How to synchronize time with NTP in Linux, Simplified Guide.