Learn Rocky Linux - Logging, Chrony & Time Synchronization

#Introduction

In the previous episode 11, you could view and manage the server from outside with Cockpit. Two things make that observability useful: logs and time — the trail of events on the system, and the ability to keep the sequence of those events consistent across the whole infrastructure.

Without logs, you can only guess what happened when the server has a problem. Without proper time synchronization, logs from two different servers can't be ordered — and cross-server incident debugging becomes a nightmare. This episode turns both into habits woven into your daily work.

#Logging on Rocky Linux

#Journald and rsyslog

Rocky Linux runs two complementary logging systems:

• journald — systemd's centralized log, collected in binary format, quickly filterable, and rich with metadata. You got to know it in episode 7.
• rsyslog — the traditional logging system that writes to text files in /var/log/ and can forward logs to a central log server.

journalctl -u sshd --since today

ls -l /var/log/

Both coexist: journald collects in detail, rsyslog persists to files and forwards them when needed.

#The /var/log Directory

Important log files you must know:

grep -i "failed password" /var/log/secure | tail

journalctl -k -b | tail

/var/log/secure is the first file opened when investigating suspicious login attempts — a habit that will pay off big in episode 15 on SSH hardening.

#Log Rotation with Logrotate

Without management, logs would eat the entire disk. logrotate handles this: rotating, compressing, and deleting old log files on a schedule.

cat /etc/logrotate.conf
ls /etc/logrotate.d/

logrotate -f /etc/logrotate.conf

Per-application configuration lives in /etc/logrotate.d/ — the habit of adding a logrotate entry for new applications prevents full disks in the future.

#Time Synchronization with Chrony

#Why Time Matters

Every server has its own clock that slowly drifts. Without synchronization, logs from different servers don't line up, TLS certificates (episode 16) appear expired or not yet valid, and distributed transactions break. The solution is chrony — the modern NTP daemon that's the standard on Rocky Linux.

#Chronyd Configuration

The chrony service is chronyd, configured in /etc/chrony.conf:

cat /etc/chrony.conf

systemctl status chronyd

The default configuration uses a public NTP pool for synchronization:

pool 2.rocky.pool.ntp.org iburst

The pool directive defines the NTP servers, and iburst speeds up initial synchronization.

#Synchronizing on Internal Servers

For internal networks without internet access, one server can be the time source for the others — the hierarchical NTP pattern common in data centers:

server 192.168.1.5 iburst

Add the server line to /etc/chrony.conf then restart chronyd:

systemctl restart chronyd

#Monitoring with Chronyc

chronyc is the control and monitoring tool for chronyd:

chronyc tracking

chronyc sources
chronyc sources -v

chronyc tracking shows synchronization status, offset, and drift — whether the clock is accurate and stable. chronyc sources -v shows which NTP servers are used and their signal quality.

#Debugging Time with Timedatectl

#System Time Status

timedatectl gives a complete picture of system time:

timedatectl

timedatectl show --property=NTP

The output shows local time, UTC time, timezone, and NTP synchronization status. NTP synchronized: yes is the state you want.

#Changing the Timezone

A correct timezone is critical for logs and schedules:

timedatectl list-timezones | grep Asia

timedatectl set-timezone Asia/Jakarta

timedatectl set-ntp true

Setting the timezone to Asia/Jakarta and making sure NTP is active will keep all your logs consistent from day one.

#Closing

In this episode 12, you mastered two pillars of Rocky Linux observability: logging with journald and rsyslog along with the important files in /var/log/ and automatic rotation with logrotate, plus time synchronization with chrony — chronyd configuration, monitoring with chronyc, and debugging time status with timedatectl.

Key takeaways:

• journald collects logs centrally; rsyslog writes them to files in /var/log/.
• /var/log/secure is the primary source for security investigations and suspicious logins.
• Use logrotate to prevent full disks from uncontrolled logs.
• chrony is the Rocky NTP standard; verify with chronyc tracking and chronyc sources.
• Make sure timedatectl shows the correct timezone and NTP is synchronized.

In the next episode 13, we will discuss firewalld and nftables — the concepts of zones and services, firewall-cmd for runtime and permanent changes, rich rules, masquerade and NAT, and the nft syntax for inspecting rules at a lower level. Time is aligned; now it's time to build its first line of defense!