Toggle sidebar Toggle sidebar

3CX SELF HOSTED - NO SYSTEM CLOCK SYNCHRONIZED

Arthur.b

Arthur.b

Platinum Partner
Advanced Certified
Joined
Oct 27, 2020
Messages
53
Reaction score
10
Hello everyone,

We've noticed during our recent installations that the systemd-timesyncd package is no longer natively included in the ISO provided on the 3CX partner portal: debian-amd64-netinst-3cx.iso.

Do you know why this change was made?

This forces us to install the package manually. Without it, we observe time drifting, and the IPBX is no longer synchronized correctly. This leads to several issues:
  • Opening hours are shifted
  • Notification problems with PWA clients
I've attached a screenshot from a freshly installed machine using the latest version of the ISO (September 8, 2025).
 

Attachments

  • timedatectl status.png
    timedatectl status.png
    4.6 KB · Views: 28
  • Like
Reactions: Kai Krakow
Hello,

We are aware of this change, introduced by the Debian 12 maintainers, and are taking steps to remedy it.
 
  • Like
Reactions: ASTERHC, Evolute IT and Arthur.b
When will this fix land? This is urgent. It breaks 2FA verification. I now installed systemd-timesyncd manually via apt, but I feel like this may break updates because in the past, the 3CX updater didn't handle manually installed packages very well (and 3CX even prevents manually installing packages by restricting the repository to their own with a limited set of packages).
 
  • Like
Reactions: Arthur.b
Dear all,

I have set local NTP server in /etc/ntpsec/ntp.conf but it seems that time is not sychronized.
I need help. According below output NTP server ntp.kc-bl.local is candidate (marked with + not with *) but not actual one.

root@UKC-3CX-KC:/var/lib/ntpsec# ntpq -p
remote refid st t when poll reach delay offset jitter
=======================================================================================================
+ntp.kc-bl.local 195.186.4.101 3 u 19 64 377 0.5506 -28017.7 0.5043
root@UKC-3CX-KC:/var/lib/ntpsec# timedatectl status
Local time: Wed 2025-11-26 10:26:34 CET
Universal time: Wed 2025-11-26 09:26:34 UTC
RTC time: Wed 2025-11-26 09:26:34
Time zone: Europe/Belgrade (CET, +0100)
System clock synchronized: yes
NTP service: n/a
RTC in local TZ: no

root@UKC-3CX-KC:/var/lib/ntpsec# more /etc/ntpsec/ntp.conf
# /etc/ntpsec/ntp.conf, configuration for ntpd; see ntp.conf(5) for help

driftfile /var/lib/ntpsec/ntp.drift
leapfile /usr/share/zoneinfo/leap-seconds.list

# To enable Network Time Security support as a server, obtain a certificate
# (e.g. with Let's Encrypt), configure the paths below, and uncomment:
# nts cert CERT_FILE
# nts key KEY_FILE
# nts enable

# You must create /var/log/ntpsec (owned by ntpsec:ntpsec) to enable logging.
#statsdir /var/log/ntpsec/
#statistics loopstats peerstats clockstats
#filegen loopstats file loopstats type day enable
#filegen peerstats file peerstats type day enable
#filegen clockstats file clockstats type day enable

# This should be maxclock 7, but the pool entries count towards maxclock.
tos maxclock 11

# Comment this out if you have a refclock and want it to be able to discipline
# the clock by itself (e.g. if the system is not connected to the network).
tos minclock 4 minsane 3

# Specify one or more NTP servers.

# Public NTP servers supporting Network Time Security:
# server time.cloudflare.com nts

# pool.ntp.org maps to about 1000 low-stratum NTP servers. Your server will
# pick a different set every time it starts up. Please consider joining the
# pool: <https://www.pool.ntp.org/join.html>
#pool 0.debian.pool.ntp.org iburst
#pool 1.debian.pool.ntp.org iburst
#pool 2.debian.pool.ntp.org iburst
#pool 3.debian.pool.ntp.org iburst
server ntp.kc-bl.local iburst prefer
# Access control configuration; see /usr/share/doc/ntpsec-doc/html/accopt.html
# for details.
#
# Note that "restrict" applies to both servers and clients, so a configuration
# that might be intended to block requests from certain clients could also end
# up blocking replies from your own upstream servers.

# By default, exchange time with everybody, but don't allow configuration.
restrict default kod nomodify nopeer noquery limited
# Local users may interrogate the ntp server more closely.
restrict 127.0.0.1
restrict ::1

root@UKC-3CX-KC:/var/lib/ntpsec# journalctl -u ntpsec.service -n 50 --no-pager
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: IO: Listen normally on 2 lo 127.0.0.1:123
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: IO: Listen normally on 3 ens18 192.168.215.60:123
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: IO: Listen normally on 4 ens19 10.130.246.203:123
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: IO: Listen normally on 5 lo [::1]:123
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: IO: Listen normally on 6 ens18 [fe80::10eb:89ff:fea8:89b8%2]:123
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: IO: Listen normally on 7 ens19 [fe80::64a1:bff:fe0d:db9f%3]:123
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: IO: Listening on routing socket on fd #24 for interface updates
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: INIT: MRU 10922 entries, 13 hash bits, 65536 bytes
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: INIT: Built with OpenSSL 3.0.9 30 May 2023, 30000090
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: INIT: Running with OpenSSL 3.0.17 1 Jul 2025, 30000110
Nov 26 09:46:32 UKC-3CX-KC ntpd[750066]: NTSc: Using system default root certificates.
Nov 26 09:46:33 UKC-3CX-KC ntpd[750066]: DNS: dns_probe: ntp.kc-bl.local, cast_flags:1, flags:20921
Nov 26 09:46:33 UKC-3CX-KC ntpd[750066]: DNS: dns_check: processing ntp.kc-bl.local, 1, 20921
Nov 26 09:46:33 UKC-3CX-KC ntpd[750066]: DNS: Server taking: 192.168.215.114
Nov 26 09:46:33 UKC-3CX-KC ntpd[750066]: DNS: dns_take_status: ntp.kc-bl.local=>good, 0
Nov 26 10:02:14 UKC-3CX-KC ntpd[750066]: ERR: ntpd exiting on signal 15 (Terminated)
Nov 26 10:02:14 UKC-3CX-KC ntpd[750066]: PROTO: 192.168.215.114 unlink local addr 192.168.215.60 -> <null>
Nov 26 10:02:14 UKC-3CX-KC systemd[1]: Stopping ntpsec.service - Network Time Service...
Nov 26 10:02:14 UKC-3CX-KC systemd[1]: ntpsec.service: Deactivated successfully.
Nov 26 10:02:14 UKC-3CX-KC systemd[1]: Stopped ntpsec.service - Network Time Service.
Nov 26 10:02:14 UKC-3CX-KC systemd[1]: Starting ntpsec.service - Network Time Service...
Nov 26 10:02:14 UKC-3CX-KC ntpd[750415]: INIT: ntpd ntpsec-1.2.2: Starting
Nov 26 10:02:14 UKC-3CX-KC ntp-systemd-wrapper[750415]: 2025-11-26T10:02:14 ntpd[750415]: INIT: ntpd ntpsec-1.2.2: Starting
Nov 26 10:02:14 UKC-3CX-KC ntp-systemd-wrapper[750415]: 2025-11-26T10:02:14 ntpd[750415]: INIT: Command line: /usr/sbin/ntpd -p /run/ntpd.pid -c /etc/ntpsec/ntp.conf -g -N -u ntpsec:ntpsec
Nov 26 10:02:14 UKC-3CX-KC ntpd[750415]: INIT: Command line: /usr/sbin/ntpd -p /run/ntpd.pid -c /etc/ntpsec/ntp.conf -g -N -u ntpsec:ntpsec
Nov 26 10:02:14 UKC-3CX-KC systemd[1]: Started ntpsec.service - Network Time Service.
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: INIT: precision = 0.068 usec (-24)
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: INIT: successfully locked into RAM
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: CONFIG: readconfig: parsing file: /etc/ntpsec/ntp.conf
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: CONFIG: restrict nopeer ignored
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: CLOCK: leapsecond file ('/usr/share/zoneinfo/leap-seconds.list'): good hash signature
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: CLOCK: leapsecond file ('/usr/share/zoneinfo/leap-seconds.list'): loaded, expire=2026-06-28T00:00Z last=2017-01-01T00:00Z ofs=37
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: INIT: Using SO_TIMESTAMPNS(ns)
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listen and drop on 0 v6wildcard [::]:123
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listen and drop on 1 v4wildcard 0.0.0.0:123
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listen normally on 2 lo 127.0.0.1:123
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listen normally on 3 ens18 192.168.215.60:123
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listen normally on 4 ens19 10.130.246.203:123
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listen normally on 5 lo [::1]:123
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listen normally on 6 ens18 [fe80::10eb:89ff:fea8:89b8%2]:123
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listen normally on 7 ens19 [fe80::64a1:bff:fe0d:db9f%3]:123
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listening on routing socket on fd #24 for interface updates
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: INIT: MRU 10922 entries, 13 hash bits, 65536 bytes
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: INIT: Built with OpenSSL 3.0.9 30 May 2023, 30000090
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: INIT: Running with OpenSSL 3.0.17 1 Jul 2025, 30000110
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: NTSc: Using system default root certificates.
Nov 26 10:02:15 UKC-3CX-KC ntpd[750417]: DNS: dns_probe: ntp.kc-bl.local, cast_flags:1, flags:20921
Nov 26 10:02:15 UKC-3CX-KC ntpd[750417]: DNS: dns_check: processing ntp.kc-bl.local, 1, 20921
Nov 26 10:02:15 UKC-3CX-KC ntpd[750417]: DNS: Server taking: 192.168.215.114
Nov 26 10:02:15 UKC-3CX-KC ntpd[750417]: DNS: dns_take_status: ntp.kc-bl.local=>good, 0
 
Hi,
You might need to let timedatectl that you are using a full ntp install: timedatectl set-ntp true
Is ntp.service set to start and running?
 
I tend to use chrony rather than ntpd these days.
https://chrony-project.org/

apt install chrony

Edit chrony.conf and comment out the following line:
#pool 2.debian.pool.ntp.org iburst

Create the file /etc/chrony/sources.d/local-ntp-server.sources (or similar) and place the following entry:
server 0.pool.ntp.org iburst prefer
Restart Chrony and sanity check
systemctl restart chronyd
systemctl status chronyd
Check connection to upstream server
chronyc sources

Hope that is helpful.

Best
Lance
 
KyriacosS_3CX said:
Hi,
You might need to let timedatectl that you are using a full ntp install: timedatectl set-ntp true
Is ntp.service set to start and running?
Click to expand...
Hi,

We use ntpsec not systemd-timesyncd.

root@UKC-3CX-KC:/var/lib/ntpsec# sudo ss -tulpn | grep ntp
udp UNCONN 0 0 10.130.246.203:123 0.0.0.0:* users:(("ntpd",pid=750417,fd=20))
udp UNCONN 0 0 192.168.215.60:123 0.0.0.0:* users:(("ntpd",pid=750417,fd=19))
udp UNCONN 0 0 127.0.0.1:123 0.0.0.0:* users:(("ntpd",pid=750417,fd=18))
udp UNCONN 0 0 0.0.0.0:123 0.0.0.0:* users:(("ntpd",pid=750417,fd=17))
udp UNCONN 0 0 [fe80::64a1:bff:fe0d:db9f]%ens19:123 [::]:* users:(("ntpd",pid=750417,fd=23))
udp UNCONN 0 0 [fe80::10eb:89ff:fea8:89b8]%ens18:123 [::]:* users:(("ntpd",pid=750417,fd=22))
udp UNCONN 0 0 [::1]:123 [::]:* users:(("ntpd",pid=750417,fd=21))
udp UNCONN 0 0 [::]:123 [::]:* users:(("ntpd",pid=750417,fd=16))
root@UKC-3CX-KC:/var/lib/ntpsec# ps -ef | grep ntp
ntpsec 750417 1 0 10:02 ? 00:00:00 /usr/sbin/ntpd -p /run/ntpd.pid -c /etc/ntpsec/ntp.conf -g -N -u ntpsec:ntpsec
root 752261 749430 0 11:36 pts/0 00:00:00 grep ntp

root@UKC-3CX-KC:/var/lib/ntpsec# sudo systemctl status ntpsec
● ntpsec.service - Network Time Service
Loaded: loaded (/lib/systemd/system/ntpsec.service; enabled; preset: enabled)
Active: active (running) since Wed 2025-11-26 10:02:14 CET; 1h 36min ago
Docs: man:ntpd(8)
Process: 750413 ExecStart=/usr/libexec/ntpsec/ntp-systemd-wrapper (code=exited, status=0/SUCCESS)
Main PID: 750417 (ntpd)
Tasks: 1 (limit: 9475)
Memory: 10.8M
CPU: 575ms
CGroup: /system.slice/ntpsec.service
└─750417 /usr/sbin/ntpd -p /run/ntpd.pid -c /etc/ntpsec/ntp.conf -g -N -u ntpsec:ntpsec

Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listen normally on 7 ens19 [fe80::64a1:bff:fe0d:db9f%3]:123
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: IO: Listening on routing socket on fd #24 for interface updates
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: INIT: MRU 10922 entries, 13 hash bits, 65536 bytes
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: INIT: Built with OpenSSL 3.0.9 30 May 2023, 30000090
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: INIT: Running with OpenSSL 3.0.17 1 Jul 2025, 30000110
Nov 26 10:02:14 UKC-3CX-KC ntpd[750417]: NTSc: Using system default root certificates.
Nov 26 10:02:15 UKC-3CX-KC ntpd[750417]: DNS: dns_probe: ntp.kc-bl.local, cast_flags:1, flags:20921
Nov 26 10:02:15 UKC-3CX-KC ntpd[750417]: DNS: dns_check: processing ntp.kc-bl.local, 1, 20921
Nov 26 10:02:15 UKC-3CX-KC ntpd[750417]: DNS: Server taking: 192.168.215.114
Nov 26 10:02:15 UKC-3CX-KC ntpd[750417]: DNS: dns_take_status: ntp.kc-bl.local=>good, 0
root@UKC-3CX-KC:/var/lib/ntpsec#
 
From this it would appear your time is synchronising OK? Perhaps we are not getting your question correctly?
 
KyriacosS_3CX said:
From this it would appear your time is synchronising OK? Perhaps we are not getting your question correctly?
Click to expand...
Hi,

Output of below commands shows that time is never sychronized by ntp server

root@UKC-3CX-KC:/var/lib/ntpsec# ^C
root@UKC-3CX-KC:/var/lib/ntpsec# ntpq -c rv
associd=0 status=c016 leap_alarm, sync_unspec, 1 event, restart,
leap=11, stratum=16, precision=-24, rootdelay=0.0, rootdisp=95.22, refid=INIT, reftime=00000000.00000000 2036-02-07T06:28:16.000Z, tc=0, peer=0, offset=0.0, frequency=0.0, sys_jitter=0.0,
clk_jitter=6e-05, clock=ecd15963.14115578 2025-11-26T10:48:03.078Z, processor="x86_64", system="Linux/6.1.0-40-amd64", version="ntpd ntpsec-1.2.2", clk_wander=0.0,
leapsec="2017-01-01T00:00Z", expire="2026-06-28T00:00Z", mintc=0

root@UKC-3CX-KC:/var/lib/ntpsec# ntpq -p
remote refid st t when poll reach delay offset jitter
=======================================================================================================
+ntp.kc-bl.local 45.87.76.3 3 u 27 64 377 0.3260 -28026.1 0.5252
root@UKC-3CX-KC:/var/lib/ntpsec#

Here is shown + instead of *
 
As we do not use ntp I cannot really comment. In past experience as long as ntp service is started, it works.

If you remove your own server, does it sync with the default ones?
 
Yes, it should works as you mentioned. We have no connection to external NTP server so I did not try at all.
 
KyriacosS_3CX said:
Hello,

We are aware of this change, introduced by the Debian 12 maintainers, and are taking steps to remedy it.
Click to expand...
Is there any progress? Time seems a critical thing for systems like 3CX
 
We always install ntp on every pbx, that fixed it for us.
 
  • Like
Reactions: paulodagraca, Arthur.b and fxbastler
You must log in or register to reply here.

Latest Posts

Forum statistics

Threads
111,953
Messages
589,915
Members
164,851
Latest member
DrunkeMeister
3CX Logo Footer Copyright © Sitemap Privacy
Top Bottom