The “Update interval” comes directly from the output of “chronyc -n tracking” called by the agent and refers to the next sync, not the previous one. It is telling us explicitly that chrony is not going to update until that interval passes. I ran a script last night to print out the “Update interval” lines whenever they changed. Sure enough, one line said “Update interval : 2069.0 seconds” and then 30 minutes later (1800 seconds) got an alert, and 4-5 minutes after that (2069 - 1800 = 269 seconds) the alert cleared. (All other values collected were between 1020 and 1050 seconds.)
So really the check could alert you to the “problem” 30 minutes earlier if it was looking at the “Update interval” rather than the “Ref time”. All of this makes me wonder, is this in fact a chrony error or is it a misunderstanding of chrony’s standard operating procedure? To me that part of the check does not appear well thought out.