How do I correlate server logs when systems use different timezones?
Convert the investigation to a common time reference, usually UTC, and include the offset in every incident timestamp. Timezone display differences do not necessarily mean clocks disagree. Clock drift, buffering and delayed shipping can still affect event ordering even when all timestamps are shown in UTC.
Before you start
- An authorised SSH session on the Linux server.
Instructions
1. Check the server’s current UTC clock
Record the UTC time and synchronisation state near the investigation. Compare with another trusted time source before concluding that an application reordered events.
date -u -Is
timedatectl statusThe ISO-formatted UTC timestamp is useful in tickets. Time-service status should be checked if authentication or certificate errors coincide with clock problems.
2. Query an explicit UTC interval
Replace the example interval with the real incident period. Keep both endpoints and UTC designation, then narrow to a service if required.
sudo journalctl --utc --since "2026-01-01 12:00:00 UTC" --until "2026-01-01 12:10:00 UTC" -n 100 --no-pager--utc changes the output display; the explicit UTC input avoids interpreting the window in an unexpected local timezone.
Check the result
- Events from each system are compared using the same timezone and a stated clock-accuracy assumption. Keep request identifiers when available to correlate independently of timestamps.
Troubleshooting
- A one-hour difference appears seasonally
- Check daylight-saving offsets in the display or application configuration.
- UTC timestamps still disagree
- Investigate actual clock skew, delayed ingestion and whether the log records event time or receipt time.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.