0

In order to match logs from two unrelated servers (in different companies) I need to account for the possible time difference between them.

We can assume that they both run ntp which point to pool.ntp.org (so, effectively, to different sources).

What is the technically sound way to compare the time on these two servers?

Ideally I would be looking for a way to query one ntp server so that it asks the other ntp server about its time and take into account the latency, jitter, etc.

If this is not possible (or doable when the servers do not see each other), should the mere fact that they are both synchronized with ntp against pool.ntp.org be good enough to assume that they are on the same time?

To clarify, I understand that there are border effects (a server which just started and and merely slowly synchronizing, the fact that when the logs were taken the circumstances may have been different, ...) - I am looking for a typical/normal scenario.

2

One way would be to create a web service on a computer that is accessible by both servers, and have them call the web service and post the current time on a specified interval. You could then review the web service logs and it would be simple math at that point, comparing the uploaded time and log timestamp for each.

  • Network latency aside, this is a good idea, thanks. – WoJ Jun 9 '16 at 11:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.