NTP synchronization issues on ESXi hosts

Products

VMware vSphere ESXi

Issue/Introduction

Accurate time synchronization is critical for environment stability. Incorrect time negatively impacts authentications, cryptographic algorithms, distributed systems such as SQL and Exchange, and Active Directory replication. This article provides diagnostic steps and resolutions for common NTP synchronization failures on VMware ESXi.

"Time skew" alerts reported by environment monitoring systems.
Testing NTP via the vCenter Server UI shows the error "Configuration is not working normally"
Host logs (/var/run/log/hostd.log) contain errors such as kernel reports TIME_ERROR: 0x4041: Clock Unsynchronized.
NTP test scripts return failure.
Advanced log analysis shows the leap_alarm string.
The reach value in NTP diagnostics is displayed as 0 or any value other than 377.

Environment

VMware vCenter Server 7.x / 8.x
VMware ESXi 7.x / 8.x

Cause

Network communication failure or intermediate firewall blocking UDP port 123.
NTP server is providing inconsistent polling to host due to high root dispersion (>= 1500ms).
Version mismatch between NTPv3 and NTPv4.
vCenter Server UI delay in reflecting the real-time synchronization status of the host.

Resolution

Validate Network Connectivity - Verify network connectivity between the ESXi host and the NTP server:
- Execute the vmkping command from the management VMkernel interface. (Typically vmk0)
```
vmkping -I vmk# <NTP server IP>
```
- Use traceroute to identify the packet path and identify potential blocks in the network.
```
traceroute <NTP server IP>
```
Query NTP Service -Use the ntpq utility to check synchronization status from the ESXi command line:
- Run the following command and monitor real-time polling output for 30 seconds:
```
watch ntpq -pn
```
- A reach value of 377 indicates successful contact over the last eight polls.
- If refid column displays INIT, the host has not received a valid response from the NTP server.
Capture Network Traffic - Verify if NTP packets are being successfully transmitted and received:
- Run a packet capture to view UDP port 123 traffic to the NTP server with:
```
tcpdump-uw -c 5 -n -i vmk# host <NTP_Server_IP> and port 123
```
Adjust Root Dispersion (tos maxdist) - If the NTP server is a Windows Domain Controller or reports high dispersion updating the tos maxdist will allow successful NTP sync:
1. Backup NTP configuration
```
cp /etc/ntp.conf /etc/ntp.conf.bak
```
2. Increase the NTP tos maxdist setting in the ntp.conf config file:
```
sed -i '/tos maxdist/d' /etc/ntp.conf
echo "tos maxdist 15" >> /etc/ntp.conf
```
3. Apply the changes and restart the NTP service:
```
esxcli system ntp set -f /etc/ntp.conf && esxcli system ntp set -e 0 && esxcli system ntp set -e 1
```
Restart NTP Daemon - If configuration is correct but synchronization is stalled:
- Restart the service:
```
/etc/init.d/ntpd restart
```

*Note: It may take one to fifteen minutes for time to synchronize to reflect accurately after the service restart.

Additional Information

Further NTP Troubleshooting: Troubleshooting NTP on ESX and the ESXi 7.x / 8.x. ESXi NTP test fails with error Configuration is not working normally
vCenter Server UI Behavior: If the vCenter Server interface does not show the updated synchronization status immediately after configuration, allow several minutes for the synchronization interval to complete and refresh the browser page.
Log Collection: For further diagnostic details, collect host logs as described in Collecting diagnostic information for VMware ESXi using vSphere Client
Configuration Guide: For detailed setup instructions, refer to the vCenter Server and Host Management
Software Downloads: To ensure your environment is on the latest release, visit Download Broadcom products, patches and software
Contact Broadcom Support: To open a new case to engage Broadcom Technical support visit Creating and managing Broadcom cases