Fix time and timezone problems in logs

safe intermediate #ntp#chrony#timezone#utc#timestamp

When to use this: Events from different devices do not line up, or logs show the wrong hour.

Before you start

Reliable investigations need all devices and the server on the same time source.

Check the server's clock and sync status
terminal
```
timedatectl
chronyc tracking
```
System clock synchronized: yes is what you want. If chronyc is missing: sudo apt install -y chrony.
Pick a single timezone policy
terminal
```
sudo timedatectl set-timezone UTC
```
Many teams store logs in UTC and convert when reading. Choose one rule and use it on server and devices.
Sync the senders

On the FortiGate set NTP (System, Settings, NTP) and the correct timezone. On ESXi enable the NTP client. A device with a wrong clock stamps every line wrongly.
Compare arrival time to device time
terminal
```
sudo tail -n 5 /var/log/remote/192.168.1.1/$(date +%Y-%m-%d).log
```
In the rsyslog config from this site each line starts with the server's arrival time, then the device's own message. A large gap between the two means the device clock is off.

Everything is exactly one or several hours off Timezone mismatch between device and server. Set the same timezone or read all logs as UTC.

Time jumps back and forth Two time sources fighting (for example host sync and NTP inside the VM). Use only one.

Why do old syslog lines have no year or timezone?

The classic RFC 3164 timestamp has only month, day and time. The newer RFC 5424 uses an ISO timestamp with timezone.

Why log in UTC?

It avoids daylight-saving ambiguity and makes events from different regions comparable.

Saved in this browser only.