Clock Skew / Time Sync Errors

TLDR - Quick Summary

Symptom: Azure storage operations fail with "Request date header too old" or "possible clock skew detected" in logs

Cause: VM system clock has drifted out of sync with the NTP time source

Fix (v3.8.1+): Run sudo systemctl restart chrony to force an immediate resync

Fix (older versions): Manually install and configure chrony with the Azure Hyper-V PTP clock

Overview

Azure Blob and File Share reject requests whose timestamps fall outside an allowed window. If the VM's system clock drifts beyond this threshold, SFTP operations will fail until the clock is corrected.

SFTP Gateway v3.8.1+ and StorageLink v1.2.0+ include automatic clock skew detection. When drift is detected, a WARN log entry is written with remediation hints.

Symptoms

• Azure storage operations fail intermittently or persistently
• Log messages containing: possible clock skew detected (v3.8.1+ / StorageLink v1.2.0+)
• Azure-specific errors in logs: Request date header too old or Request date header too new

Diagnosis

Run the following commands to check time sync status:

chronyc tracking
timedatectl status

If the output shows System clock synchronized: no, or the Last offset value is more than a few seconds, the clock is out of sync.

Fix — SFTP Gateway v3.8.1+ / StorageLink v1.2.0+

These versions ship with chrony pre-configured to use the Azure Hyper-V PTP clock (/dev/ptp_hyperv).

To force an immediate resync:

sudo systemctl restart chrony

Private Networks / Custom NTP Server

If your server is in a private network without access to the default NTP sources, edit the chrony configuration file directly:

sudo vi /etc/chrony/chrony.conf

Replace the pool pool.ntp.org ... line with your internal NTP server:

server ntp.internal.yourcompany.com iburst

Then restart chrony.

Fix — Older Versions (pre-v3.8.1 / pre-StorageLink v1.2.0)

Older Azure VM images may be using systemd-timesyncd instead of chrony. Replace it:

# Install chrony
sudo apt-get update
sudo apt-get install -y chrony

# Disable systemd-timesyncd to avoid conflicts
sudo systemctl stop systemd-timesyncd
sudo systemctl disable systemd-timesyncd

Then write the Azure chrony configuration:

sudo tee /etc/chrony/chrony.conf > /dev/null <<'EOF'
refclock PHC /dev/ptp_hyperv poll 3 dpoll -2 offset 0 stratum 2
pool pool.ntp.org iburst maxsources 2
driftfile /var/lib/chrony/chrony.drift
makestep 1.0 3
rtcsync
logdir /var/log/chrony
EOF

Then enable and restart:

sudo systemctl enable chrony
sudo systemctl restart chrony

# Verify sync
chronyc tracking

Containers / Kubernetes

Container deployments inherit the host's clock. If running on AKS, the underlying node should already have the Azure Hyper-V PTP clock available. Verify with chronyc tracking on the node.