SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-log-time-sync-ntp

Why does NIST advise using NTP to keep log sources' clocks consistent?

So events from many systems can be lined up in the right time order during investigations.

Start playing free

  1. Events from different systems can be correlated in time ✔
  2. It encrypts log files in transit
  3. It compresses logs to save disk space

Why: If servers disagree about the time, you cannot tell what happened first. Accurate timestamps let analysts reconstruct an attack across firewalls, servers and endpoints. NTP keeps all the clocks in sync.

Huh, didn't know that: NIST notes out-of-sync sources may require adding or subtracting time from entries.

The dad joke
My servers disagree on the time, so the log says the breach happened tomorrow.
Like this card?
Play the game

References

Answer: Events from different systems can be correlated in time. If servers disagree about the time, you cannot tell what happened first. Accurate timestamps let analysts reconstruct an attack across firewalls, servers and endpoints. NTP keeps all the clocks in sync.

  1. NIST SP 800-92, Guide to Computer Security Log Management nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf
    use time synchronization technologies such as Network Time Protocol (NTP) servers whenever possible to keep log sources’ clocks consistent with each other.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyIn syslog (RFC 5424), which severity code is the most severe?Security & PrivacyWhat does a SIEM mainly do with the log data it collects?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?

That's stuff everyone should know.