Why is time synchronization (NTP) important in log management?

• A. It reduces log sizes.
• B. It replaces device clocks.
• C. It ensures events across systems can be correlated accurately.
• D. It hides timing differences for stealth.

Answer: (C)

Time synchronization is about aligning clocks across devices so log timestamps share a single, consistent timeline. In log management, timestamps drive how we stitch together events from multiple systems. When devices have different clocks, events can appear out of order or seem unrelated, making it hard to reconstruct timelines, correlate alerts, or perform accurate forensic analysis. NTP provides a reliable way to synchronize all device clocks to a common reference, typically Coordinated Universal Time, so web servers, databases, routers, and endpoints all log events using the same time base. With synchronized timestamps, you can accurately correlate events across systems, determine the true sequence of actions, and build reliable timelines for investigations or incident response. The other options don’t fit: reducing log sizes isn’t affected by time alignment, NTP doesn’t replace device clocks but harmonizes them to a reference, and it doesn’t hide timing differences—when clocks are synchronized, timing is consistent and traceable.