SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-log-clock-sync

Why should every logging host use a common time source?

Synchronized clocks let analysts order events across systems.

Start playing free

  1. To correlate event timelines ✔
  2. To compress every log
  3. To eliminate authentication

Why: An incident may leave traces in an application, firewall, identity service, and database. If their clocks disagree, the apparent event order can be misleading.

Huh, didn't know that: NIST log guidance lists syncing each logging host to a common time source as a basic log management step.

The dad joke
The logs synchronized watches before telling their stories.
Like this card?
Play the game

References

Answer: To correlate event timelines. An incident may leave traces in an application, firewall, identity service, and database. If their clocks disagree, the apparent event order can be misleading.

  1. NIST SP 800-92 nvlpubs.nist.gov/nistpubs/legacy/SP/nistspecialpublication800-92.Pdf
    Ensuring that each logging host’s clock is synched to a common time source
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich three goals form the CIA triad?Security & PrivacyWhich password property most directly increases resistance to guessing?Security & PrivacyWhat does current NIST guidance say about password composition rules?

That's stuff everyone should know.