IBM Support

QRadar: Resolving Chrony PID File Conflict

Troubleshooting


Problem

Running the command /opt/qradar/bin/time_sync.sh, which internally starts chronyd, a unrecoverable error occurs with the following message in the logs:

Fatal error : Another chronyd may already be running (pid=XXXXXX), check /run/chrony/chronyd.pid

Symptom

The chronyd service shows as inactive (dead) when checking its status with:

systemctl status chronyd

The new instance of chronyd is started but quickly stops due to the existing process's active PID file.

Cause

The error is due to an existing chronyd process that was either left over from a previous session or became stuck. This existing process holds the /run/chrony/chronyd.pid file, preventing a new instance from starting.

Environment

This issue can occur on QRadar hosts where the time_sync.sh script is run to synchronize time by using chronyd.

Diagnosing The Problem

Check the status of chronyd using:

systemctl status chronyd

If it shows "Active: inactive (dead)," it confirms that the process is not running. Verify that the /run/chrony/chronyd.pid file exists and contains a PID. This file indicates that a chronyd process was previously running or is still holding the file.

Resolving The Problem

  1. Remove the existing chronyd.pid file: 
    sudo rm -f /run/chrony/chronyd.pid

  2. Restart the chronyd service:

    sudo systemctl restart chronyd

  3. Enable the chronyd service to start on system startup:

    sudo systemctl enable chronyd

  4. Confirm that chronyd is running: 

    systemctl status chronyd

    Expected output is:

    Active: active (running)

  5. Re-run the time_sync.sh script:

    /opt/qradar/bin/time_sync.sh

The script can now run successfully, synchronizing time that uses chronyd.

In summary, this technote addresses a chrony PID file conflict issue in QRadar. The problem occurs when an existing chronyd process holds the /run/chrony/chronyd.pid file, preventing a new instance from starting. To resolve this issue, remove the existing chronyd.pid file, restart the chronyd service, enable it to start on boot, confirm it's running, and then re-run the time_sync.sh script.

Document Location

Worldwide

 
 

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0.0;7.1.0;7.2.0;7.2.2;7.2.3;7.2.4;7.2.5;7.2.6;7.2.7;7.2.8;7.3.0;7.3.1;7.3.2;7.3.3;7.4.0;7.4.1;7.4.2;7.4.3;7.5.0"}]

Document Information

Modified date:
18 June 2025

UID

ibm17237009

Page Feedback