CentOS 7.x时间同步服务chrony配置详解
作者：尹正杰
版权声明：原创作品，谢绝转载！否则将追究法律责任。
一.时间服务概述
1>.为什么需要时间服务器
事实上,我们各种电子设备它们都是靠时钟驱动的,在分布式场景当中，更多主机的协作也是靠时钟驱动的。因此，多节点的主机时间必须要一致。
以Linux为例，Linux的时间是系统启动时,内核会从主板的硬件资源读取时间并设置为内核中的时钟。接下来系统时间和硬件的内核时间是各自分开独立运行的。
由于操作系统在运行过程中CPU繁忙等各种原因，久而久之很可能会导致系统时钟不精确的显现，这种不精确反应在同一个集群的多台主机上其实就是集群时间不一致。
我们大家都知道虚拟机并获得的CPU是虚拟机产品虚拟出来的CPU，并不是我们真正物理机上的CPU，因此出现时间误差的概率是相当的大，所以在我们普遍使用云计算的虚拟机上，必须要配置一个时间服务器，否则可能各个虚拟机的时间出现不一致的情况。
2>.ntpd时间服务
以RedHat的Linux发行版为例,早期用来解决时间服务器(CentOS 6.x版本之前)的程序包是ntpd，该程序包既可以用作服务端又可以用作客户端。ntpd是基于NTP(Network Time Protocal)实现时间同步的。 ntdp的实现同步时间的逻辑： 它的思想是把时间的周期缩短，举个例一个比较极限的例子，假设一台服务器两台服务器时间相差1小时，它的思想就是将自己现有的时间周期缩短，从而间接追上时间服务器的时间。比如时间服务器跑一分钟需要60秒，而ntpd的思想是跑一分钟使用30秒甚至1秒实现跑一分钟的的时间周期，这样随着时间的推移一定会追上服务器时间的。这种方式的确是可以追到服务器时间，但是为了追到服务器时间会付出一定时间的代价，这也是ntpd之所以被淘汰的根本原因。 生产环境中,你是否也发现了这样的现象呢？明明在部署集群时时间配置是正确的，可能过了2三个月后，你会发现集群中总有那么几台及其出现时间不同步的情况。这里的根本问题在于ntpd在和时间服务器进行时间同步的核心逻辑问题，因此CentOS7.x版本将CentOS6.x版本的ntpd替换为chronyd服务啦。 配置ntpd作为时间服务器案例(博主推荐使用使用chronyd作为服务端，尽管我之前也分效果使用ntpd作为服务端的比较)： https://www.cnblogs.com/yinzhengjie/p/9480665.html
3>.chrony时间服务
chrony是网络时间协议（NTP）的通用实现。它可以将系统时钟与NTP服务器、参考时钟（例如GPS接收器）和使用手表和键盘的手动输入同步。它还可以作为NTPv4（RFC 5905）服务器和对等服务器运行，为网络中的其他计算机提供时间服务。 它被设计成在各种条件下都能很好地运行，包括断续的网络连接、严重拥挤的网络、不断变化的温度（普通的计算机时钟对温度很敏感），以及不连续运行或在虚拟机上运行的系统。 chrony是ntpd的替代方案。在互联网上同步的两台机器之间的典型精度在几毫秒内；在局域网上，精度通常在几十微秒内。使用硬件时间戳或硬件参考时钟，可以达到亚微秒精度。 chrony中包含两个程序，chronyd是一个可以在启动时启动的守护程序，chronyc是一个命令行接口程序，可用于监视chronyd的性能，并在运行时更改各种操作参数。 如果非要把NTP和chrony做一个对比的话，我们就以手动调整手表时间为例，我们假设手表时间和实际服务器时间相差3小时: ntpd的解决思路就是飞速的转动秒针，以最快的速度调准时间，可想而是，我们需要非常快的速度转动180圈秒针才能追上时间服务器的时间,真个转动过程是相当费时间的。 chrony的解决思路就是直接调整时针,可想而知，我们挑拨时针不到一圈就能把问题解决掉了，这就是为什么生产环境中大家使用的时间服务器基本上都是chrony啦。 和ntpd一样，chronyd程序包既可以做服务端也可以做客户端，实际上chrony服务本身是兼容ntpd服务的,我们直到123/UDP是传统的NTP服务所默认监听的端口，而323/UDP是chrony所默认监听的端口。因此我们使用chronyd做服务端后，我们既可以使用ntpd做客户端也可以使用chronyd做客户端。 chrony的官方网站: https://chrony.tuxfamily.org/
4>.chrony的优势
chrony是网络时间协议(NTP)的另一种实现,与网络时间协议后台程序(ntpd)不同,它可以更快地且更准确地同步系统时钟，请注意，ntpd仍然包含其中以供需要运行NTP服务的客户使用。
chrony的优势包括以下几点:
(1)更快的同步只需要数分钟而非数小时时间，从而最大程度减少时间和频率误差，这对于并非全天24小时的运行的台式计算机或系统而言非常有用；
(2)能够更好地响应时钟频率的快速变化，这对于具备不稳定时钟的虚拟机或导致赛事中频率发生比变化的节能技术;
(3)在初始同步后，它不会停止时钟，以防对需要系统时间保持单调的应用程序造成影响;
(4)在应对临时非对称延迟时(例如大规模下载造成链接饱和等情况)提供了更好的稳定性;
(5)无需对时间服务器进行定期轮询，因此具备间歇性网络连接(如网络不稳定的场景)的系统仍然可以快速同步时钟。
二.安装并配置chrony服务
1>.安装chrony
[root@master200.yinzhengjie.org.cn ~]# yum -y install chrony Loaded plugins: fastestmirror Determining fastest mirrors * base: mirror.bit.edu.cn * extras: mirror.bit.edu.cn * updates: mirrors.huaweicloud.com ambari-repo | 2.9 kB 00:00:00 base | 3.6 kB 00:00:00 extras | 2.9 kB 00:00:00 mysql-connectors-community | 2.5 kB 00:00:00 mysql-tools-community | 2.5 kB 00:00:00 mysql80-community | 2.5 kB 00:00:00 updates | 2.9 kB 00:00:00 (1/2): extras/7/x86_64/primary_db | 159 kB 00:00:00 (2/2): updates/7/x86_64/primary_db | 5.9 MB 00:00:00 Resolving Dependencies --> Running transaction check ---> Package chrony.x86_64 0:3.4-1.el7 will be installed --> Processing Dependency: libseccomp.so.2()(64bit) for package: chrony-3.4-1.el7.x86_64 --> Running transaction check ---> Package libseccomp.x86_64 0:2.3.1-3.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved ============================================================================================================================================================================================================================================================================== Package Arch Version Repository Size ============================================================================================================================================================================================================================================================================== Installing: chrony x86_64 3.4-1.el7 base 251 k Installing for dependencies: libseccomp x86_64 2.3.1-3.el7 base 56 k Transaction Summary ============================================================================================================================================================================================================================================================================== Install 1 Package (+1 Dependent package) Total download size: 306 k Installed size: 788 k Downloading packages: (1/2): libseccomp-2.3.1-3.el7.x86_64.rpm | 56 kB 00:00:00 (2/2): chrony-3.4-1.el7.x86_64.rpm | 251 kB 00:00:00 ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Total 957 kB/s | 306 kB 00:00:00 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : libseccomp-2.3.1-3.el7.x86_64 1/2 Installing : chrony-3.4-1.el7.x86_64 2/2 Verifying : libseccomp-2.3.1-3.el7.x86_64 1/2 Verifying : chrony-3.4-1.el7.x86_64 2/2 Installed: chrony.x86_64 0:3.4-1.el7 Dependency Installed: libseccomp.x86_64 0:2.3.1-3.el7 Complete! [root@master200.yinzhengjie.org.cn ~]#
2>.查看chrony是否已经安装
[root@master200.yinzhengjie.org.cn ~]# yum info chrony Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.aliyun.com * extras: mirror.bit.edu.cn * updates: mirror.bit.edu.cn Installed Packages Name : chrony Arch : x86_64 Version : 3.4 Release : 1.el7 Size : 491 k Repo : installed #很显然，这里已经提示咱们该程序包已经安装成功啦~ From repo : base Summary : An NTP client/server URL : https://chrony.tuxfamily.org License : GPLv2 Description : A client/server for the Network Time Protocol, this program keeps your : computer's clock accurate. It was specially designed to support : systems with intermittent internet connections, but it also works well : in permanently connected environments. It can use also hardware reference : clocks, system real-time clock or manual input as time references. [root@master200.yinzhengjie.org.cn ~]#
3>.查看chrony服务安装的文件
[root@master200.yinzhengjie.org.cn ~]# rpm -ql chrony /etc/NetworkManager/dispatcher.d/20-chrony /etc/chrony.conf #chrony的主配置文件 /etc/chrony.keys /etc/dhcp/dhclient.d/chrony.sh /etc/logrotate.d/chrony /etc/sysconfig/chronyd /usr/bin/chronyc #chronyc是一个命令行交互式接口程序，可用于监视chronyd的性能，并在运行时更改各种操作参数。 /usr/lib/systemd/ntp-units.d/50-chronyd.list /usr/lib/systemd/system/chrony-dnssrv@.service /usr/lib/systemd/system/chrony-dnssrv@.timer /usr/lib/systemd/system/chrony-wait.service /usr/lib/systemd/system/chronyd.service #CentOS 7.x版本对应的unit file /usr/libexec/chrony-helper /usr/sbin/chronyd #chronyd是一个可以在启动时启动的守护程序，它既可以充当服务端进程也可以充当服务端进程 /usr/share/doc/chrony-3.4 /usr/share/doc/chrony-3.4/COPYING /usr/share/doc/chrony-3.4/FAQ /usr/share/doc/chrony-3.4/NEWS /usr/share/doc/chrony-3.4/README /usr/share/man/man1/chronyc.1.gz /usr/share/man/man5/chrony.conf.5.gz /usr/share/man/man8/chronyd.8.gz /var/lib/chrony /var/lib/chrony/drift /var/lib/chrony/rtc /var/log/chrony [root@master200.yinzhengjie.org.cn ~]#
4>.查看chrony的帮助手册
[root@master200.yinzhengjie.org.cn ~]# man chrony.conf #查看chrony的配置文件帮助信息 [root@master200.yinzhengjie.org.cn ~]# [root@master200.yinzhengjie.org.cn ~]# man chronyd #查看chrony的守护进程帮助信息
5>.服务端的配置文件(标记为粉红色字体需要注意，其它使用默认参数即可，对其它字段感兴趣的小伙伴可以参考上面的帮助信息哟)
[root@master200.yinzhengjie.org.cn ~]# cat /etc/chrony.conf #指定当前节点为服务器时间,生产环境中建议大家指定多个事件服务器哟,起到对时间服务器备份的效果 server master200.yinzhengjie.org.cn iburst # Record the rate at which the system clock gains/losses time. driftfile /var/lib/chrony/drift # Allow the system clock to be stepped in the first three updates # if its offset is larger than 1 second. makestep 1.0 3 # Enable kernel synchronization of the real-time clock (RTC). rtcsync # Enable hardware timestamping on all interfaces that support it. #hwtimestamp * # Increase the minimum number of selectable sources required to adjust # the system clock. #minsources 2 #指定允许的客户端网段来当前时间服务器节点同步时间,我们可以使用deny all拒绝所有客户端。 allow 172.200.0.0/21 #注意,如果主机位是0的话可以简写，比如下面的地址可以简写为"127/8",不过建议大家还是写完整，可读性更强。 allow 127.0.0.0/8 #如果上面使用server字段配置的时间服务器同步时间失败,默认情况下当前时间服务器是不会向客户端同步时间的, #这是因为担心当前节点的时间不准确(因为当前节点没有和定义中的server时间服务器进行同步),如果我们想要在 #server指定的时间服务器同步失败的情况下依旧返回当前时间服务器的时间给客户端，需要开启该参数,这一项参 #数配置在生产环境中还是相当危险的，因此建议大家在server字段中指定互联网的网络时间,否则可能会出现整个 #集群时间都错的的一致! local stratum 10 # Specify file containing keys for NTP authentication. #keyfile /etc/chrony.keys # Specify directory for log files. logdir /var/log/chrony # Select which information is logged. #log measurements statistics tracking [root@master200.yinzhengjie.org.cn ~]# [root@master200.yinzhengjie.org.cn ~]#
6>.客户端配置(标记为粉红色字体需要注意，其它使用默认参数即可，对其它字段感兴趣的小伙伴可以参考上面的帮助信息哟)
[root@node201.yinzhengjie.org.cn ~]# egrep -v "^#|^$" /etc/chrony.conf server master200.yinzhengjie.org.cn iburst driftfile /var/lib/chrony/drift makestep 1.0 3 rtcsync logdir /var/log/chrony [root@node201.yinzhengjie.org.cn ~]#
7>.将chrony服务设置为开启自启动
[root@master200.yinzhengjie.org.cn ~]# systemctl start chronyd [root@master200.yinzhengjie.org.cn ~]# [root@master200.yinzhengjie.org.cn ~]# systemctl enable chronyd [root@master200.yinzhengjie.org.cn ~]# [root@master200.yinzhengjie.org.cn ~]# systemctl list-unit-files | grep chronyd chronyd.service enabled [root@master200.yinzhengjie.org.cn ~]# [root@master200.yinzhengjie.org.cn ~]# systemctl status chronyd ● chronyd.service - NTP client/server Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled) Active: active (running) since Sun 2020-02-09 23:42:18 CST; 15h ago Docs: man:chronyd(8) man:chrony.conf(5) Main PID: 4678 (chronyd) CGroup: /system.slice/chronyd.service └─4678 /usr/sbin/chronyd Feb 09 23:42:17 master200.yinzhengjie.org.cn systemd[1]: Starting NTP client/server... Feb 09 23:42:18 master200.yinzhengjie.org.cn chronyd[4678]: chronyd version 3.4 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +SECHASH +IPV6 +DEBUG) Feb 09 23:42:18 master200.yinzhengjie.org.cn chronyd[4678]: Frequency 0.298 +/- 0.488 ppm read from /var/lib/chrony/drift Feb 09 23:42:18 master200.yinzhengjie.org.cn systemd[1]: Started NTP client/server. Feb 09 23:42:28 master200.yinzhengjie.org.cn chronyd[4678]: Selected source 172.200.1.200 [root@master200.yinzhengjie.org.cn ~]# [root@master200.yinzhengjie.org.cn ~]#
8>.查看chrony服务的监听端口
[root@master200.yinzhengjie.org.cn ~]# ss -untlp Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port udp UNCONN 0 0 *:123 *:* users:(("chronyd",pid=4678,fd=7))udp UNCONN 0 0 *:8472 *:* udp UNCONN 0 0 127.0.0.1:323 *:* users:(("chronyd",pid=4678,fd=5))udp UNCONN 0 0 ::1:323 :::* users:(("chronyd",pid=4678,fd=6))tcp LISTEN 0 20480 127.0.0.1:10248 *:* users:(("kubelet",pid=4659,fd=28))tcp LISTEN 0 20480 127.0.0.1:10249 *:* users:(("kube-proxy",pid=7373,fd=13))tcp LISTEN 0 20480 172.200.1.200:2379 *:* users:(("etcd",pid=6708,fd=6))tcp LISTEN 0 20480 127.0.0.1:2379 *:* users:(("etcd",pid=6708,fd=5))tcp LISTEN 0 20480 172.200.1.200:2380 *:* users:(("etcd",pid=6708,fd=3))tcp LISTEN 0 20480 127.0.0.1:2381 *:* users:(("etcd",pid=6708,fd=11))tcp LISTEN 0 20480 127.0.0.1:10257 *:* users:(("kube-controller",pid=6593,fd=6))tcp LISTEN 0 20480 127.0.0.1:10259 *:* users:(("kube-scheduler",pid=6659,fd=6))tcp LISTEN 0 128 *:22 *:* users:(("sshd",pid=5129,fd=3))tcp LISTEN 0 20480 127.0.0.1:17369 *:* users:(("kubelet",pid=4659,fd=9))tcp LISTEN 0 20480 :::10250 :::* users:(("kubelet",pid=4659,fd=23))tcp LISTEN 0 20480 :::30443 :::* users:(("kube-proxy",pid=7373,fd=10))tcp LISTEN 0 20480 :::10251 :::* users:(("kube-scheduler",pid=6659,fd=5))tcp LISTEN 0 20480 :::6443 :::* users:(("kube-apiserver",pid=6595,fd=5))tcp LISTEN 0 20480 :::10252 :::* users:(("kube-controller",pid=6593,fd=5))tcp LISTEN 0 20480 :::10256 :::* users:(("kube-proxy",pid=7373,fd=14))tcp LISTEN 0 128 :::22 :::* users:(("sshd",pid=5129,fd=4))tcp LISTEN 0 20480 :::30080 :::* users:(("kube-proxy",pid=7373,fd=8))[root@master200.yinzhengjie.org.cn ~]#
三.查看服务端和客户端时间是否同步完成
1>.以交互式方式(支持命令补全)查看时间同步资源
[root@master200.yinzhengjie.org.cn ~]# [root@master200.yinzhengjie.org.cn ~]# chronyc chrony version 3.4 Copyright (C) 1997-2003, 2007, 2009-2018 Richard P. Curnow and others chrony comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the GNU General Public License version 2 for details. chronyc> chronyc> sources 210 Number of sources = 1 MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^* master200.yinzhengjie.or> 10 10 377 15h -180ns[-2930ns] +/- 7588ns chronyc> chronyc>
2>.以交互式方式(支持命令补全)查看时间同步正常是否正常
[root@node201.yinzhengjie.org.cn ~]# chronyc chrony version 3.4 Copyright (C) 1997-2003, 2007, 2009-2018 Richard P. Curnow and others chrony comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the GNU General Public License version 2 for details. chronyc> chronyc> sourcestats 210 Number of sources = 1 Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev ============================================================================== master200.yinzhengjie.or> 64 34 14h -0.000 0.001 -1ns 52us chronyc> chronyc>
3>.以非交互式方式(注意，不支持命令补全哟)查看时间同步资源详细信息
[root@node201.yinzhengjie.org.cn ~]# chronyc sources -v 210 Number of sources = 1 .-- Source mode '^' = server, '=' = peer, '#' = local clock. / .- Source state '*' = current synced, '+' = combined , '-' = not combined, | / '?' = unreachable, 'x' = time may be in error, '~' = time too variable. || .- xxxx [ yyyy ] +/- zzzz || Reachability register (octal) -. | xxxx = adjusted offset, || Log2(Polling interval) --. | | yyyy = measured offset, || | | zzzz = estimated error. || | | MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^* master200.yinzhengjie.or> 11 10 377 8 +383ns[ +554ns] +/- 117ms [root@node201.yinzhengjie.org.cn ~]#
4>.通过chronyc交互式接口配置chrony访问可参考帮助信息(不推荐使用，建议直接修改"/etc/chrony.conf"配置文件)
[root@master200.yinzhengjie.org.cn ~]# chronyc chrony version 3.4 Copyright (C) 1997-2003, 2007, 2009-2018 Richard P. Curnow and others chrony comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the GNU General Public License version 2 for details. chronyc> help System clock: tracking Display system time information makestep Correct clock by stepping immediately makestep <threshold> <updates> Configure automatic clock stepping maxupdateskew <skew> Modify maximum valid skew to update frequency waitsync [<max-tries> [<max-correction> [<max-skew> [<interval>]]]] Wait until synchronised in specified limits Time sources: sources [-v] Display information about current sources sourcestats [-v] Display statistics about collected measurements reselect Force reselecting synchronisation source reselectdist <dist> Modify reselection distance NTP sources: activity Check how many NTP sources are online/offline ntpdata [<address>] Display information about last valid measurement add server <address> [options] Add new NTP server add peer <address> [options] Add new NTP peer delete <address> Remove server or peer burst <n-good>/<n-max> [<mask>/<address>] Start rapid set of measurements maxdelay <address> <delay> Modify maximum valid sample delay maxdelayratio <address> <ratio> Modify maximum valid delay/minimum ratio maxdelaydevratio <address> <ratio> Modify maximum valid delay/deviation ratio minpoll <address> <poll> Modify minimum polling interval maxpoll <address> <poll> Modify maximum polling interval minstratum <address> <stratum> Modify minimum stratum offline [<mask>/<address>] Set sources in subnet to offline status online [<mask>/<address>] Set sources in subnet to online status onoffline Set all sources to online or offline status according to network configuration polltarget <address> <target> Modify poll target refresh Refresh IP addresses Manual time input: manual off|on|reset Disable/enable/reset settime command manual list Show previous settime entries manual delete <index> Delete previous settime entry settime <time> Set daemon time (e.g. Sep 25, 2015 16:30:05 or 16:30:05) NTP access: accheck <address> Check whether address is allowed clients Report on clients that have accessed the server serverstats Display statistics of the server allow [<subnet>] Allow access to subnet as a default allow all [<subnet>] Allow access to subnet and all children deny [<subnet>] Deny access to subnet as a default deny all [<subnet>] Deny access to subnet and all children local [options] Serve time even when not synchronised local off Don't serve time when not synchronised smoothtime reset|activate Reset/activate time smoothing smoothing Display current time smoothing state Monitoring access: cmdaccheck <address> Check whether address is allowed cmdallow [<subnet>] Allow access to subnet as a default cmdallow all [<subnet>] Allow access to subnet and all children cmddeny [<subnet>] Deny access to subnet as a default cmddeny all [<subnet>] Deny access to subnet and all children Real-time clock: rtcdata Print current RTC performance parameters trimrtc Correct RTC relative to system clock writertc Save RTC performance parameters to file Other daemon commands: cyclelogs Close and re-open log files dump Dump all measurements to save files rekey Re-read keys from key file shutdown Stop daemon Client commands: dns -n|+n Disable/enable resolving IP addresses to hostnames dns -4|-6|-46 Resolve hostnames only to IPv4/IPv6/both addresses timeout <milliseconds> Set initial response timeout retries <retries> Set maximum number of retries keygen [<id> [<type> [<bits>]]] Generate key for key file exit|quit Leave the program help Generate this help chronyc>