What does the security-log clock-skew checker produce?
Compare paired log and reference timestamps for the same known event. Calculate signed offsets in milliseconds and flag offsets above your selected tolerance.
The working area above runs the supported validator in the browser. It keeps the result inspectable and preserves every unresolved item for responsible review.
What do you need before you start?
- Define and authorize the source population. Keep the exact original source separately.
- Use UTF-8 CSV, rectangular text dataset JSON or one-sheet text-cell XLSX starting at A1. Limits are 10 MB, 5000 data rows, 50 columns, 100000 cells and 5000000 parsed characters. Formulas, macros, additional sheets and numeric date cells are rejected.
- Pair the same known event on both clocks and name the reference clock. Select a maximum absolute offset in seconds.
What information do you enter?
Prepare only the bounded inputs listed below for this validator.
- One event per row. Use Event reference, Event timestamp and Trusted timestamp, or the displayed aliases.
- Exact YYYY-MM-DDTHH:mm:ss timestamps with optional one through three fractional digits and Z or a numeric offset within 14 hours. Years 1900 through 2200.
- Maximum absolute offset from 0 through 86400 seconds with at most three decimal places, and a recorded reference clock and pairing basis.
| Field | What to enter | Fictional example |
|---|---|---|
| Maximum absolute offset (seconds)Required | Enter 0 through 86400 seconds with at most three decimal places. An exact boundary passes.Accepted range 0 to 86400. | 1 |
| Reference clock and event-pairing basisRequired | Name the reference clock and explain how each row identifies the same event on both clocks. Do not substitute receipt time for event time without reviewing delay. | Fictional paired event IDs from the same test event. Fictional UTC reference clock. |
What you can download
Every result must identify its supplied facts, assumptions and unresolved items.
| Free result | Included downloads |
|---|---|
Enter your information, inspect the on-screen result and keep a browser backup. Editing and direct copies of your entered information stay free. |
These supported outputs are free. No checkout is required. |
Fictional temporal review (PDF). Editable review (DOCX). Complete fictional pack (ZIP). Fictional source dataset (JSON). Requires tailoring. Samples use the finalized renderer. Keep real source and result files private.
How does the security-log clock-skew checker work?
- 1Select the actual source
Import a supported local source or load the clearly fictional example. Inspect headings and preserve the exact original download.
- 2Freeze your review inputs
Record the reference clock and same-event pairing basis. Select the tolerance. The tool never identifies an authoritative clock itself.
- 3Inspect every row
Review signed offsets in milliseconds, UTC conversions and threshold findings. Positive means the event timestamp is ahead. Invalid or duplicate rows remain unresolved.
- 4Keep the review and original
Download complete source and result JSON or CSV free. Purchase the seven-file finalized pack after review. The pack contains original parsed values and must remain private.
Method and sources
Apply the steps above to the supported inputs. Use the listed source sections to review the rule basis, assumptions and limits.
- Date and Time on the Internet. TimestampsA primary timestamp reference. The tool implements a bounded subset with explicit exclusions, not complete RFC validation. Sections 4 and 5. Numeric offsets and timestamp syntax.RFC Editor. Reviewed 2026-10-06.
- Guide to Computer Security Log ManagementContext for reviewing event correlation, clocks and timestamp significance. No maximum clock offset is inferred. Log management and timestamp synchronization.National Institute of Standards and Technology. Reviewed 2026-10-06.
Common questions
What information does the security-log clock-skew checker need?
Enter one event per row. Use Event reference, Event timestamp and Trusted timestamp, or the displayed aliases; exact YYYY-MM-DDTHH:mm:ss timestamps with optional one through three fractional digits and Z or a numeric offset within 14 hours. Years 1900 through 2200; maximum absolute offset from 0 through 86400 seconds with at most three decimal places, and a recorded reference clock and pairing basis. Define and authorize the source population. Keep the exact original source separately.
What does the security-log clock-skew checker produce?
Complete row-level timestamp offsets or evidence freshness findings. Free complete parsed source and result JSON, CSV and unchanged original source download. Seven-file finalized pack with formal PDF and DOCX, Excel, CSV, complete source JSON, hashes and instructions. Review unresolved findings and limitations before use.
Who makes the final decision?
A responsible person reviews the result. An observed timestamp difference does not establish clock error alone. Confirm the event pairing, reference clock, timestamp meaning and transport delays. The tool does not correct logs, synchronize clocks or infer a trusted source.
Is this tool free?
Yes. The on-screen result and listed downloads are free. No checkout is required. Keep local backups and review the stated method and limits.
Can I use the security-log clock-skew checker for this task?
Compare paired log and reference timestamps for known events and flag offsets above your tolerance. An observed timestamp difference does not establish clock error alone. Confirm the event pairing, reference clock, timestamp meaning and transport delays. The tool does not correct logs, synchronize clocks or infer a trusted source.
What still needs review?
An observed timestamp difference does not establish clock error alone. Confirm the event pairing, reference clock, timestamp meaning and transport delays. The tool does not correct logs, synchronize clocks or infer a trusted source.
This bounded timestamp profile is not a complete RFC 3339 validator. Leap seconds, more than three fractional digits, -00:00, time-zone names, whitespace and missing offsets are unsupported.
PDF and DOCX summaries show the first 100 result rows. Complete source and results remain in Excel, CSV and JSON. CSV uses spreadsheet-safe review escaping. JSON preserves exact parsed text.