NTP Server & Time Synchronization Logs

Location

Description

Network Time Protocol server and client logs recording time synchronization events, stratum changes, peer status, clock drift corrections, and authentication failures between NTP clients and servers.

Forensic Value

NTP logs validate the accuracy of timestamps across all other forensic artifacts. Clock drift records help determine if system times were accurate during the investigation period. NTP authentication failures may indicate time-based attacks or unauthorized NTP sources. Sudden time changes in NTP logs can indicate attacker attempts to manipulate system clocks to undermine forensic timelines or bypass time-based security controls like Kerberos ticket validation.

Tools Required

Collection Commands

ntpq -p -w > ntp_peers.txt && ntpstat >> ntp_peers.txt && ntpq -c rl >> ntp_peers.txt

chronyc tracking > chrony_status.txt && chronyc sources -v >> chrony_status.txt && chronyc activity >> chrony_status.txt

journalctl -u chronyd --since "7 days ago" --no-pager > ntp_journal.txt && journalctl -u systemd-timesyncd --since "7 days ago" --no-pager >> ntp_journal.txt

MITRE ATT&CK Techniques