Query NTP Safely with ntpdig Before Changing the Clock

ntpdig will happily nudge your system clock backwards mid-transaction if you let it, so this guide keeps it read-only until you have a reason not to. You will finish with a safe query, a machine-readable JSON result for scripts, and a deliberate choice between stepping and slewing. Examples use NTPsec ntpdig 1.2.2, from the ntpsec-ntpdig package version 1.2.2+dfsg1-4build2.

Allow about ten minutes. You need a shell, network access to an NTP or SNTP server, and the ntpdig package. The first half is unprivileged and only reads time. The clock-setting examples normally need root and can hit running services, logs and authentication if the correction is large.

1. Check the installed client

Confirm the program and version before trusting examples written for a different NTP implementation:

$ command -v ntpdig
/usr/bin/ntpdig
$ ntpdig --version
ntpdig ntpsec-1.2.2

The installed build accepts --version, and its help output also shows -V as the short form. Do not assume options from the classic sntp utility still apply: NTPsec deliberately removed several old ones, including -b, -K, -o, -r, -w and -W.

2. Query a server without changing time

Start with a server name your organisation or distribution actually supplies. The public pool below is only an example:

$ ntpdig -4 -t 2 pool.ntp.org
2026-09-25 07:42:46.285599 (+0100) +0.006008 +/- 0.006850 pool.ntp.org 185.232.69.65 s1 no-leap

Without -S or -s, this never sets the clock. The line shows local time, offset in seconds, synchronisation distance, server address, stratum and leap indication. An offset of +0.006008 means the local clock is running about six milliseconds ahead, so it would need to move backwards to match the server.

• -4 forces IPv4 resolution. Use -6 when you specifically need IPv6.
• -t 2 caps the wait at two seconds. The installed default is five. A short timeout suits an interactive check but can be too aggressive on a slow or distant link.

$ printf '%s\n' "$?"
0

3. Request JSON for a script

Use -j when another program needs the result. It suppresses syslog messages and writes a self-describing JSON record to standard output instead:

$ ntpdig -4 -j -t 2 pool.ntp.org
{"time":"2026-09-25T07:42:46.285599+0100","offset":0.006008,"precision":"0.006850","host":"pool.ntp.org","ip":"185.232.69.65","stratum":1,"leap":"no-leap","adjusted":false}

Two fields are easy to misread. The one called precision is actually the synchronisation distance, not the server's clock precision. And adjusted tells you whether ntpdig decided a correction should have happened; it stays false for a read-only run like this.

Do not parse the human-readable line with awk when JSON is right there. For a shell health check, preserve the exit status and keep diagnostics separate:

if result=$(ntpdig -4 -j -t 5 pool.ntp.org); then
    printf '%s\n' "$result"
else
    status=$?
    printf 'ntpdig failed with status %s\n' "$status" >&2
    exit "$status"
fi

4. Query more than one sample

Use -p to request multiple samples; the default is one. ntpdig picks the best sample, weighing factors including synchronisation distance:

$ ntpdig -4 -p 3 -t 5 pool.ntp.org

Watch out for DNS names that return several addresses. By default ntpdig treats them as one server instance and leaves a two-second gap between requests. Reach for -c with a host name only when its returned addresses genuinely represent different machines, such as a properly managed server pool:

$ ntpdig -4 -c pool.ntp.org

Concurrent requests increase load on the sources being queried. It is not a general speed switch, so if you do not know how the name is operated, leave -c out.

5. Choose how a clock correction should happen

Do not run either of these casually. Both change the system clock, normally need elevated privilege, and should only follow a healthy read-only query against a trusted, synchronised server.

• -S steps the clock, applying the correction directly. Appropriate for a large offset or when an immediate fix is needed. It can jump timestamps abruptly, which confuses applications, scheduled work and log analysis. Do not use it while an independent time daemon is also controlling the clock.
• -s slews the clock, changing the rate gradually with adjtime(). No sudden jump, but it takes longer to remove a large offset.

$ sudo ntpdig -4 -S -t 5 time.example.net

$ sudo ntpdig -4 -s -t 5 time.example.net

You can make the choice depend on a threshold with -M, whose value is in milliseconds. Here, corrections under 128 milliseconds are slewed and anything larger is stepped:

$ sudo ntpdig -4 -S -s -M 128 -t 5 time.example.net

The manual frames -S as enabling correction by stepping and -s as enabling correction by slewing; combining them with -M is intentional. A value of zero means every adjustment is stepped. Keep this out of automation until you have checked how your existing time service is configured.

6. Diagnose a failed query

A failed query returns status 1. Capture the error before running anything else:

$ ntpdig -4 -t 2 time.example.net
ntpdig: no eligible servers
$ printf '%s\n' "$?"
1

Check the name and network path without changing any system state:

$ getent ahosts time.example.net
$ ntpdig -4 -d -t 5 time.example.net

NTPsec's ntpdig does not log to syslog. If a scheduled job needs local logging, pipe standard output and standard error to your system's logger command, or use -l with a deliberately chosen logfile, and check permissions and rotation before pointing a long-running job at a new path.