---
title: Use Synchronized Time (UTC) In Logs
impact: MEDIUM
impactDescription: enables accurate incident correlation and audit trail reconstruction across distributed systems
tags: logging, time, utc, synchronization, security, kotlin
---

## Use Synchronized Time (UTC) In Logs

When an incident occurs, investigators need to correlate logs from multiple servers, databases, and third-party services. If timestamps are in different timezones or out of sync, reconstructing the timeline is nearly impossible.

**Incorrect (local time or inconsistent formats):**

```kotlin
// Uses server's local timezone
logger.info("User action at ${Date()}")

// Inconsistent formats
println("[${System.currentTimeMillis()}] Event")
println("[${LocalDateTime.now()}] Event")
```

**Correct (UTC with ISO 8601 format):**

```kotlin
import java.time.Instant
import java.time.format.DateTimeFormatter

// 1. Use Instant (Always UTC)
val timestamp = Instant.now().toString() // Output: 2024-01-15T10:30:00.000Z

// 2. Structured logging with ISO 8601 (Recommended)
logger.info("User action") {
    payload("timestamp" to Instant.now().toString())
    payload("userId" to user.id)
}

// 3. Configure Logback to use UTC
// In logback.xml:
// <timestamp key="bySecond" datePattern="yyyy-MM-dd'T'HH:mm:ss.SSS'Z'" timeReference="UTC"/>
```

**System Requirements:**
- **UTC Everywhere:** Application logic, database storage, and logs should all use UTC.
- **ISO 8601:** Use the standardized format `YYYY-MM-DDTHH:mm:ss.SSSZ`.
- **NTP:** Ensure all servers in the cluster use the Network Time Protocol (NTP) to stay synchronized with a precise time source.
- **Precision:** Log with at least millisecond precision.

**Tools:** `java.time` (JSR-310), Logback, NTP, Sentry, Elasticsearch/Kibana