In order to match logs from two unrelated servers (in different companies) I need to account for the possible time difference between them.
We can assume that they both run
ntp which point to
pool.ntp.org (so, effectively, to different sources).
What is the technically sound way to compare the time on these two servers?
Ideally I would be looking for a way to query one
ntp server so that it asks the other
ntp server about its time and take into account the latency, jitter, etc.
If this is not possible (or doable when the servers do not see each other), should the mere fact that they are both synchronized with
pool.ntp.org be good enough to assume that they are on the same time?
To clarify, I understand that there are border effects (a server which just started and and merely slowly synchronizing, the fact that when the logs were taken the circumstances may have been different, ...) - I am looking for a typical/normal scenario.