NTP Offset Log Checker

NTP or chrony rows:

Paste one peer table or CSV extract with offset and jitter/error evidence. Values without units are treated as milliseconds.

{{ fileStatus || 'Drop NTP, chrony, CSV, TXT, or LOG output onto the textarea.' }}

Offset gate:

Use a strict single-digit gate for precise time-sensitive services, or a larger gate for branch infrastructure triage.

Jitter/error gate:

This catches variable or uncertain peers even when the instantaneous offset is small.

Maximum stratum:

Keep this aligned with the tier expected for the device or site being checked.

stratum

Selection policy:

Use warning mode for peer-table checks; choose Ignore when analyzing exported CSV rows without source markers.

NTP source input needs attention

{{ error }}

Visible peer limit:

Raise this only when reviewing a large estate export.

peers

Metric	Value	Interpretation	Copy
{{ row.metric }}	{{ row.value }}	{{ row.note }}

Peer	Offset	Jitter/error	Stratum	Reach	Source state	Status	Parser	Copy
{{ row.peer }}	{{ row.offsetDisplay }}	{{ row.jitterDisplay }}	{{ row.stratumDisplay }}	{{ row.reachDisplay }}	{{ row.sourceState }}	{{ row.status }}	{{ row.format }}

Finding	Severity	Evidence	Suggested next check	Copy
{{ row.finding }}	{{ row.severity }}	{{ row.evidence }}	{{ row.nextCheck }}

Export to PDF Fullscreen

Embed:

Customize

Include current inputs

Size

Advanced

Width

Height

Aspect ratio

Max height

Collapsible embed

Allow fullscreen

Referrer policy

Sandbox tokens

NTP offset logs show how far each configured time source appears to be from the local clock. That gap matters for authentication, distributed logs, certificate validation, database ordering, and incident timelines, because a host can look healthy while its clock is far enough away to break time-sensitive systems.

Offset is only one part of the picture. A source with a small current offset can still be noisy, unreachable, too far down the stratum chain, or ignored by the daemon's source-selection logic. A useful review compares offset, jitter or error, reachability, stratum, and selected-source evidence before deciding whether a host is safe to use as a time authority.

Diagram of NTP peer rows plotted by offset and jitter against review gates.

A drift check is most useful during maintenance windows, domain-controller review, Kubernetes or database incident follow-up, and branch-network triage. The result does not prove that NTP is correctly configured forever. It reads the rows you provide, applies the gates you choose, and shows which peers deserve the next check.

Treat large offsets and missing selected-source markers as evidence for investigation, not as a full root-cause diagnosis. Clock problems can come from upstream source choice, path delay, packet loss, virtualization time sources, leap state, daemon configuration, or a host that has not yet settled after startup.

Technical Details:

The Network Time Protocol estimates the time difference between the local clock and remote sources by exchanging timestamped packets, filtering samples, and selecting sources that survive sanity checks. RFC 5905 describes offset and jitter as the final timing values used to discipline the system clock, and it treats stratum values at the maximum value as invalid for synchronization.

Peer-table output is a compact operational view of that process. In an ntpq peer row, offset and jitter are timing values in milliseconds. In chronyc sources, the visible sample contains a measured offset plus a +/- error margin. In chronyc sourcestats, Std Dev reflects variation in the offset estimate. Those values are related but not identical, so repeated comparisons should use the same command family where possible.

Reachability and source selection protect against false comfort. A peer can report a small offset while recent polls are missing, while a daemon can list several candidates but still have no selected source. The review therefore combines numeric gates with parser and status checks.

NTP offset log input formats and parsed fields
Input form	Parsed evidence	Important note
`ntpq -pn` peer rows	Peer, marker, stratum, reach, delay, offset, and jitter.	Timing columns are read as milliseconds when no unit is shown.
`chronyc sources` rows	Source marker, peer, stratum, reach, last-sample offset, and `+/-` error margin.	The error margin is checked against the jitter/error gate.
`chronyc sourcestats` rows	Peer, estimated offset, and `Std Dev`.	Stratum and selected-source markers are not present in this format.
CSV rows	Host or peer plus offset, jitter/error, stratum, optional marker, reach, and delay.	Header names such as `offset_ms`, `jitter_ms`, `stddev`, `state`, and `reach` are recognized.
Plain rows	Peer, offset, jitter/error, stratum, optional marker, reach, and delay.	The first four whitespace-separated fields must contain peer, offset, jitter/error, and stratum.

NTP offset log rule checks and severity boundaries
Check	Boundary	Severity	Meaning
Offset	`\|offset_ms\| > Offset gate`	Warning, or High at four times the gate or at least `1000 ms`.	The peer is farther from the local clock than the selected review tolerance.
Jitter/error	`jitter_or_error_ms > Jitter/error gate`	Warning, or High at three times the gate.	The peer is variable or uncertain even if the current offset is small.
Stratum	`stratum > Maximum stratum`; `stratum >= 16`	Warning above policy; Critical at `16` or higher.	The source is farther away than expected, or it reports an unsynchronized state.
Source marker	`*` or `o` selected; `x` or `?` unusable; `~` variable.	Clear for selected, High for unusable, Warning for too variable.	The daemon's source-selection mark can outweigh a friendly-looking offset row.
Reach	Octal reach `0`, or any octal value other than `377`.	High at `0`; Warning when incomplete.	Recent polls are missing, so the current peer view may be stale or unstable.
Selected source	Marker-aware rows exist, selection policy is warning mode, and none are marked `*` or `o`.	High.	The peer table has status markers, but no source is currently selected.
Parser coverage	Non-empty lines are skipped, or no usable peer row is found.	Warning for skipped lines; High for no parsed rows.	The input shape needs cleanup before the result can be trusted.

The rule boundaries use strict greater-than checks for offset and jitter/error, so a value exactly equal to the configured gate remains inside that gate. Positive and negative offsets are treated symmetrically by absolute value, while jitter/error is read as a non-directional amount of variation or uncertainty.

Everyday Use & Decision Guide:

Start with one raw peer table from the host you are checking. Leave the default Offset gate at 50 ms, Jitter/error gate at 20 ms, Maximum stratum at 4, and Selection policy on warning mode for a first branch-server or general infrastructure pass.

Tighten the gates for systems where a few milliseconds matter, such as authentication services, databases that compare timestamps across hosts, or time authorities used by other devices. Loosen them only when the goal is broad triage across remote branch devices with slower links. Keep the same gates when comparing multiple hosts so the worst peer list is not created by inconsistent policy.

Use ntpq sample or chrony sample to confirm the expected row shape before pasting production output.
Use Normalize after copying from a terminal or ticket. It removes trailing spaces and normalizes line endings without changing the actual values.
Choose Ignore selected-source markers for CSV extracts that do not carry status symbols. Keep warning mode for live ntpq or chronyc sources output.
Raise Visible peer limit only for large fleet exports. The table display may be shortened, but the chart and JSON keep every parsed peer.
Check Drift Findings before exporting. It names the finding, severity, evidence, and the next technical check for each flagged row.

A clear result does not mean the clock path is perfect. It only means the rows you supplied stayed within the configured offset, jitter/error, stratum, reachability, and marker checks. For maintenance evidence, save the result together with the command output time, host name, and the gate values you used.

If a host will serve time to other machines, do not rely on one green summary. Confirm that Sync Snapshot shows a selected source, that Peer Ledger has full or improving reach, and that Offset Jitter Map does not hide one outlier outside the gates.

Step-by-Step Guide:

Work from the raw daemon output first, then adjust gates only when the operational tolerance is clear.

Paste peer output into NTP or chrony rows, or use Browse to load a TXT, LOG, or CSV file under 1 MB. If the field is empty, the page shows Paste NTP, chrony, or CSV peer rows before using the checker.
Press Normalize if the pasted text came from a terminal, email, or ticket. If no rows parse, the validation area shows No peer rows were parsed from the current source text.
Set Offset gate, Jitter/error gate, and Maximum stratum. Negative gate values are rejected with field-specific validation messages.
Set Selection policy. Use warning mode for status-marked ntpq or chronyc sources rows, and ignore marker checks for plain CSV exports that never included * or o.
Review the summary box. NTP Sources In Gate means no findings crossed the gates, NTP Source Review means warning findings exist, and Time Drift Risk means High or Critical evidence was found.
Open Sync Snapshot for peer count, flagged count, largest offset, worst jitter/error, policy gates, selected source, and parse coverage.
Open Peer Ledger to inspect each peer's offset, jitter/error, stratum, reach, source state, status, and parser format. Adjust Visible peer limit only if the table hides rows you need to inspect.
Use Drift Findings to decide the next check. A finding can point to upstream selection, path stability, daemon synchronization, UDP/123 reachability, or source-output cleanup.
Open Offset Jitter Map when visual outliers matter. Points beyond the offset or jitter gate should match rows in Peer Ledger and findings in Drift Findings.
Use JSON, CSV, DOCX, or chart exports only after the row parsing and gate values match the maintenance record you intend to share.

The clean finish is a snapshot where the parsed peer count, selected-source status, largest offset, worst jitter/error, and findings all describe the same command output.

Interpreting Results:

The headline value is the largest absolute offset, but the strongest judgment comes from the findings table. A host with 0.80 ms offset and reach 0 needs attention sooner than a quiet host with a slightly larger but stable offset inside policy.

How to interpret NTP offset log outputs
Output cue	What it means	Useful follow-up
`NTP Sources In Gate`	Every parsed peer stayed inside the current checks.	Archive the gates and source rows if this is change evidence.
`NTP Source Review`	At least one Warning finding exists.	Inspect `Drift Findings` before deciding whether the host can wait.
`Time Drift Risk`	High or Critical evidence exists, such as a severe offset, unreachable peer, unusable source state, or stratum `16`.	Check daemon synchronization and upstream reachability before relying on the host clock.
`Source lines skipped`	Some non-empty input lines were not recognized as supported peer rows.	Normalize the source text or convert it to `host,offset_ms,jitter_ms,stratum` CSV.
`No selected time source`	Status-marked rows were present, but none had `*` or `o`.	Confirm source selection before making the host a time source for other devices.

A low offset does not prove that NTP is healthy. Verify the selected-source marker, reach value, stratum, and jitter/error before trusting a row. When a finding looks surprising, compare the same host with a fresh ntpq -pn or chronyc sources run instead of mixing command families.

Worked Examples:

Branch router with a drifting peer

An ntpq -pn table contains a selected source near -0.743 ms, a candidate near 1.214 ms, and branch-rtr.local at 64.800 ms offset with 23.900 ms jitter and reach 177. With the default 50 ms offset gate and 20 ms jitter/error gate, Sync Snapshot reports the largest Offset on branch-rtr.local. Drift Findings lists offset, jitter/error, and incomplete reach warnings, so the next check is the router path and upstream source selection.

Chrony source with a wide error margin

A chronyc sources row shows ^* for the selected source and an offset around -743 us, while another source shows +64.8 ms with +/- 24 ms. The selected marker keeps the source-selection check clear, but the peer with 24.000 ms error crosses the default Jitter/error gate. In Peer Ledger, read that value as uncertainty from the chrony row rather than classic ntpq jitter.

CSV export that reveals an unsynchronized source

A CSV line such as edge-fw,3.2,0.9,16 parses cleanly even without a marker. Peer Ledger shows stratum 16 and status Critical, while Drift Findings reports Unsynchronized stratum. The small offset and jitter values do not rescue the row, because stratum 16 means the source should not be trusted for synchronization.

Troubleshooting a pasted ticket excerpt

A ticket paste includes headings, comments, and one partial line with no numeric offset. The checker skips the recognizable headings, but Sync Snapshot may show weak parse coverage and Drift Findings may list Source lines skipped or No peer rows parsed. The fix is to press Normalize, remove unrelated ticket text, or convert the evidence to CSV with host,offset_ms,jitter_ms,stratum.

FAQ:

Which NTP outputs can I paste?

You can paste ntpq -pn peer rows, chronyc sources, chronyc sourcestats, CSV rows, or plain rows with peer, offset, jitter/error, and stratum. TXT, LOG, and CSV files under 1 MB are read through the same parser.

Why does chrony error count as jitter/error?

chronyc sources reports a +/- margin of error next to the last sample, while chronyc sourcestats reports Std Dev. The checker compares those uncertainty values with Jitter/error gate because both can flag unstable or uncertain sources.

What does reach 377 mean?

Reach is an octal recent-poll register. The checker treats 377 as fully populated recent reachability, 0 as High severity, and any other octal reach value as incomplete.

Why do I get No selected time source?

That finding appears when marker-aware rows are present, Selection policy is in warning mode, and none of the parsed rows are marked * or o. Switch to ignore mode only for exports that never included source-selection markers.

Are pasted logs uploaded to a server?

No. Pasted text and loaded TXT, LOG, or CSV files are parsed in the browser, and file-size validation happens before the file text is placed into the input area. Exports are generated from the current browser state.

Glossary:

NTP: Network Time Protocol, used to synchronize system clocks with selected time sources.
Offset: The estimated time difference between the local clock and a source, reported here in milliseconds.
Jitter/error: A variation or uncertainty value used to catch sources that are noisy even when the current offset is small.
Stratum: A source's distance from a primary reference clock, with stratum 16 treated here as unsynchronized.
Reach: An octal recent-poll register; 377 means the recent reachability register is full.
Selected source: The peer currently chosen by the daemon, shown as * in typical peer output or o for a PPS peer.

References:

Network Time Protocol Version 4: Protocol and Algorithms Specification, IETF, June 2010.
chronyc(1), chrony project documentation.
ntpq(1) NTPsec manual page, Debian manpages.
NTP FAQ and HOWTO: General Issues, Network Time Foundation.