FULL AI ANALYSIS

Debian guest clock jumps forward after KVM snapshot restore, causing missed cron jobs and certificate timing errors

Generated Oct 3, 2026, 12:35:03 AM

Analysis summary

Large guest clock jumps typically occur when a VM is suspended or snapshotted and the guest clock (hwclock or kernel timebase) diverges from real time on resume. systemd-timesyncd may step time or refuse immediate synchronization if NTP is not yet reachable. Some services (or TLS libraries) are sensitive to non-monotonic jumps.

Possible causes

Host paused/suspended the VM for extended time; on resume the guest clock was advanced or not reconciled with real time.

95%

Guest uses hardware clock that was not updated when the snapshot was taken, leading to inconsistent rtc/hwclock values at resume.

80%

Misconfigured NTP/systemd-timesyncd that delays or refuses a step correction until network is fully up.

75%

Missing hypervisor tool integration (no paravirtualized clock sync from guest tools) so guest cannot query host clock on resume.

65%

Suggested fixes

1

Diagnostic step 1

Short-term recovery without full reboot: allow systemd-timesyncd/chrony to step time by making NTP reachable. If service-blocking problems persist, temporarily stop time-sensitive services, run 'sudo timedatectl set-ntp false' then 'sudo ntpdate -u <ntp-server>' (or 'chronyc -a makestep' if using chrony) to force a step, then restart services. These commands are reversible.

2

Diagnostic step 2

Prefer chrony on virtualized guests: install and enable chrony which handles large time steps and suspend/resume better than systemd-timesyncd in many environments.

3

Diagnostic step 3

Enable paravirtualized clock synchronization: install/enable the guest agent or hypervisor-specific tools (qemu-guest-agent) so the host can notify guests on resume to resync the clock.

4

Diagnostic step 4

On the hypervisor, avoid long suspended states during maintenance or ensure host triggers guest clock update at resume (libvirt and qemu have options to sync time).

5

Diagnostic step 5

For scheduled tasks, write cron-based guards (check for large clock skew on startup) and for certificate checks add short startup retries if time errors are transient. Escalation: If host behavior cannot be changed or chrony does not resolve the issue, involve virtualization infrastructure admin or host vendor — changes to host resume behavior may be required.