---
title: Use Synchronized Time (UTC) In Logs
impact: MEDIUM
impactDescription: enables accurate incident correlation
tags: logging, time, utc, synchronization, security
---

## Use Synchronized Time (UTC) In Logs

Inconsistent timestamps across servers/services make incident investigation difficult. Use UTC and ISO 8601 format.

**Incorrect (local time/custom formats):**

```go
// Local time - depends on server TZ
log.Printf("Event time: %v", time.Now())

// Different formats
fmt.Println(time.Now().Unix())
fmt.Println(time.Now().Format("2006-01-02"))
```

**Correct (UTC, ISO 8601):**

```go
// Use .UTC() and .Format(time.RFC3339)
slog.Info("User action", 
    "timestamp", time.Now().UTC().Format(time.RFC3339Nano), 
    "action", "login",
)

// Output: {"timestamp":"2024-01-15T10:30:00.123456Z", "level":"INFO", "message":"User action", "action":"login"}
```

**Requirements:**
- Use UTC timezone externally.
- Use ISO 8601 (RFC 3339) with nanosecond/millisecond precision.
- Ensure servers are NTP-synchronized.

**Tools:** `time` (Standard Library), `slog`, NTP