No announcement yet.

Time Stamp Uses Internal Clock

  • Filter
  • Time
  • Show
Clear All
new posts

  • Time Stamp Uses Internal Clock

    Hi, Good day to y'all.

    Is there a way to prove that the time stamps used in the system (audit logs, etc.) are referenced to the system's internal clock?


  • #2
    AFAIK the times used in your event logs are referenced from the system time which is typically referenced from your PDC Emulator on a domain or the BIOS clock if not.


    • #3
      The only clock used comes from the system's mainboard clock (real or virtualized). Whether that clock is updated to stay in sync with the rest of the system or an external reference (i.e. Internet time updates or a domain controller) is another matter. But as for 'proving' that your server's internal clock is what's used for time referencing your events, vs some external source, I've never even heard of a tool that gets current time info from some external source to apply to your event logging, or any other tagging.
      MSCA (2003/XP), Security+, CCNA

      ** Remember: credit where credit is due, and reputation points as appropriate **


      • #4
        Click image for larger version

Name:	18-09-2015 9-33-46 AM.png
Views:	1
Size:	33.0 KB
ID:	493045
        Good point Rickles. Working in a domain environment you forget the BIOS clock pretty much controls everything.

        I will also add that as far as I'm led to believe if you connect a system that is not in the same time zone as the server then it will set the times to that of the local machine as apparently the logs use UTC then your system converts the time into your local time zone when you access.

        Last edited by wullieb1; 18th September 2015, 00:44.