---
title: Use Synchronized Time (UTC) In Logs
impact: MEDIUM
impactDescription: enables accurate incident correlation across distributed systems
tags: logging, time, utc, synchronization, security, php
---

## Use Synchronized Time (UTC) In Logs

Inconsistent or incorrect timestamps across multiple servers make it extremely difficult to correlate events during an incident investigation. You must use a synchronized time source (NTP) and log all events in UTC using the ISO 8601 format.

**Incorrect (local time or inconsistent formats):**

```php
// Local timezone - varies by server config
Log::info("User logged in at " . date("Y-m-d H:i:s"));

// Non-standard formats
Log::info("[" . time() . "] Action performed");
```

**Correct (UTC and ISO 8601):**

```php
// 1. Explicitly sets UTC (Recommended for all backend apps)
date_default_timezone_set('UTC');

// 2. Using ISO 8601 format (DateTimeInterface::ATOM)
$now = (new DateTime('now', new DateTimeZone('UTC')))->format(DateTimeInterface::ATOM);
Log::info('Order processed', [
    'timestamp' => $now, // Example: 2024-05-10T15:20:00+00:00
    'order_id' => 123
]);

// 3. In Laravel (config/app.php)
'timezone' => 'UTC',

// 4. Using Carbon (Laravel/Symfony)
Log::info('Event', [
    'timestamp' => now()->toIso8601String()
]);
```

**Synchronization Strategy:**
- **Server Clock**: Use NTP (Network Time Protocol) to ensure all application and database servers are synchronized to the millisecond.
- **Internal Storage**: Store all timestamps in the database as UTC. Convert to local time only when displaying to the end-user.
- **Log Format**: Prefer structured JSON logs where the timestamp is a top-level field in ISO 8601 format.

**Why ISO 8601?**
It is unambiguous, machine-readable, and includes timezone offset information (usually `Z` or `+00:00`), making it the gold standard for log aggregation tools like Elasticsearch or Graylog.

**Tools:** NTP, Monolog (with UTC formatter), Carbon, `date_default_timezone_set()`