Build a timeline from three sources that disagree about time

applied · 80 min · Objective 2.4

Task

Correlate three logs into a single timeline, with the clocks deliberately out of sync, and discover that an unsynchronised estate produces a timeline that is confidently wrong rather than obviously broken.

Steps

  1. Generate three synthetic logs describing ONE sequence of events: a mail gateway log, a web server access log and an authentication log. Write them with a script so the underlying event times are known.
  2. Deliberately skew them: write the mail log in UTC, the web log in a local timezone six hours behind, and the auth log with a clock that is eleven minutes fast.
  3. Now build the timeline naively: merge all three by their printed timestamps and write the result to /tmp/naive.txt.
  4. Read the naive timeline and write down the story it tells. Note that it is a coherent story and that it is wrong — the login appears to precede the email that caused it.
  5. Write /tmp/normalise.py: convert every line to UTC, correcting the known skew, and re-merge into /tmp/corrected.txt.
  6. Compare the two orderings and record in /tmp/timeline.md which conclusions changed, and what in the naive version would have made a responder chase the wrong user.

Verify

wc -l < /tmp/naive.txt /tmp/corrected.txt
python3 - <<'PY'
n=[l.split()[0] for l in open('/tmp/naive.txt') if l.strip()]
c=[l.split()[0] for l in open('/tmp/corrected.txt') if l.strip()]
assert len(n)==len(c), 'the two timelines contain different numbers of events'
assert n!=c, 'normalisation changed nothing - the skew was not applied'
first_diff=next(i for i,(a,b) in enumerate(zip(n,c)) if a!=b)
print('timelines diverge at event', first_diff+1, 'of', len(n))
PY
grep -icE "utc|skew|order|precede" /tmp/timeline.md

The assertion that matters is n != c: the corrected ordering must differ from the naive one, which proves the skew was real and that normalising changed the story. If they match, the offsets were not applied and the lab has demonstrated nothing.

Notes

This is why NTP is a security control and not an operations detail. An unsynchronised estate does not produce an obviously broken timeline that somebody questions — it produces a plausible one that sends the investigation at the wrong person, and nothing in it looks wrong.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.