A timestamp records when an event occurred. Network devices attach timestamps to log entries such as interface changes, OSPF neighbor transitions, and CLI logins, enabling event correlation. section 2.1.1
Cisco IOS timestamp behavior includes:
- Syslog timestamps may use event date and time with datetime or device uptime with uptime. section 7.2.1
- datetime uses UTC by default; localtime selects the local time zone, and msec adds milliseconds. section 7.2.1
- Accurate, synchronized clocks make log correlation across devices practical; unsynchronized clocks make diagnosis harder. section 2.1.1
Correlating an OSPF failure
A log records an OSPF neighbor entering Full at 16:34 and Down at 16:35 after a dead timer expired. Comparing show clock output on both routers can reveal whether their timestamps are trustworthy. section 2.1.1
R1# show logging . . . Aug 28 16:34:07.860: %OSPF-5-ADJCHG: Process 1, #1 Nbr 10.0.0.2 on GigabitEthernet0/0 from LOADING to #1 FULL, Loading Done #1 Aug 28 16:35:07.080: %OSPF-5-ADJCHG: Process 1, #2 Nbr 10.0.0.2 on GigabitEthernet0/0 from FULL to #2 DOWN, Neighbor Down: Dead timer expired #2 #1 An OSPF neighbor entered the Full state. #2 The same OSPF neighbor entered the Down state due to an expired dead timer.
Inspect timestamped Syslog entries showing an OSPF neighbor entering Full and later going Down. section 2.1.1
