Wazuh NTP Server

[mt b]

Hi everyone!

I know that wazuh server uses the O.S.'s NTP server. 

Where does this appear in the official documentation? 

I couldn't find it. 

[hasitha.u...@wazuh.com]

Hi mt,

Please allow me some time; I’m currently looking into this and will get back to you with an update as soon as possible.

[hasitha.u...@wazuh.com]

Hi mt,

Yes, you are right. This is not mentioned explicitly in the documentation, but we can confirm it by checking the system time synchronization.
The output shows that the server is synchronized with NTP correctly.
In chronyc sources -v, the entry marked with ^* shows the NTP server that is currently being used as the main time source. In this case, it is prod-ntp-3.ntp1.ps5.canonical.com.

1. root@node:/home/vagrant# chronyc sources -v
2.  
3.   .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
4.  / .- Source state '*' = current best, '+' = combined, '-' = not combined,
5. | /             'x' = may be in error, '~' = too variable, '?' = unusable.
6. ||                                                 .- xxxx [ yyyy ] +/- zzzz
7. ||      Reachability register (octal) -.           |  xxxx = adjusted offset,
8. ||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
9. ||                                \     |          |  zzzz = estimated error.
10. ||                                 |    |           \
11. MS Name/IP address         Stratum Poll Reach LastRx Last sample              
12. ===============================================================================
13. ^- prod-ntp-3.ntp4.ps5.cano>     2   6    17    12    +16ms[  +16ms] +/-  107ms
14. ^- alphyn.canonical.com          2   6    17    12  +1412us[+1412us] +/-  143ms
15. ^- prod-ntp-5.ntp4.ps5.cano>     2   6    17    12    +20ms[  +20ms] +/-  109ms
16. ^* prod-ntp-3.ntp1.ps5.cano>     2   6    17    13  -2833us[  -16ms] +/-  103ms
17. ^- time.cloudflare.com           3   6    17    13  +8561us[+8561us] +/-   95ms
18. ^+ time.cloudflare.com           3   6    17    13  -2978us[  -16ms] +/-  106ms
19. ^- time.cloudflare.com           3   6    17    13    +12ms[  +12ms] +/-  101ms

The chronyc tracking output also shows that time synchronization is working properly. The line System time : 0.000047941 seconds fast of NTP time means the server time is only slightly ahead of NTP time, which is normal.

1. root@node:/home/vagrant# chronyc tracking
2. Reference ID    : B97DBE38 (prod-ntp-3.ntp1.ps5.canonical.com)
3. Stratum         : 3
4. Ref time (UTC)  : Sun Mar 15 07:21:29 2026
5. System time     : 0.000047941 seconds fast of NTP time
6. Last offset     : -0.013018744 seconds
7. RMS offset      : 0.013018744 seconds
8. Frequency       : 0.000 ppm slow
9. Residual freq   : -2868.354 ppm
10. Skew            : 1000000.000 ppm
11. Root delay      : 0.205044389 seconds
12. Root dispersion : 23.716863632 seconds
13. Update interval : 0.8 seconds
14. Leap status     : Normal
15. root@node:/home/vagrant#

Other values in the output also look healthy. The Reference ID shows the active time source, Stratum : 3 is a normal value, and Leap status : Normal indicates that time synchronization is in a good state.

Let me know if you need further assistance on this.