Last Updated: 2024-12-03

I once wrote a 30-liner bug description to D about an authorization error causing downtime for a station operator. This was because I saw auth error messages in the logs at 11am, exactly the time the bug occured.

When D read this report that evening evening, he said that my explanation can't be right: he -- not the station operator -- was the one who triggered the auth errors -- at 1pm, two hours later.

What had happened was that I saw both times in the log (GMT+2 and UTC) and that there was a 2 hour difference. However, I did not consider direction. I should have checked the docs for which column represented which timezone, or looked to the log tail and see what the current time is with reference to the most recent entry (e.g. if I know it is 11am here in GMT+2, and the most recent request in the logs is 9am, then its timezone must be UTC)

Lesson

Establish the timezone of any time entry before doing any deeper analysis.

The first step in any analysis of logs is checking whether the timezone is UTC or local time. Don't assume. Work it out.