# time precision of system logs

All,

As part of an SF writing project, I would like information on the accuracy of computer system logs, worldwide. One could think of a global map that had a tiny dot for every computer or phone that would indicate the precision of each device. I am more interested in precision (basically measuring the intervals) but information on absolute accuracy is also welcome. For example, when I look in my MAC console, I see precision apparently to a microsecond.

Also of interest:

• High end, government scientific machines that record much higher precision?
• GPS spatial precision for given time precision?

Thanks for any help

======================================================================

Here is an edit after many comments, hoping to address issues mentioned.

Prior to this post, I had found: https://www.iol.unh.edu/sites/default/files/knowledgebase/1588/ptp_overview.pdf

The idea was to ask the question: If I could access every computer device in the world (servers, phones, workstations, laptops, ..., excluding things like fridges) and I mined the, for each device, the most accurate timestamp for a common event (assume that event stamps at the accuracy that the device would normally write to the highest accuracy log), what would the histogram of timestamp accuracy look like. Based on the reference above, I guessed that most would be at the 10 millisecond level, a sizeable number at the 10 microsecond and a few at the 10 nanosecond level. A map of the accuracy, plotted over the world, would look noisy but with the definite hierarchy above. My question is: is that a correct picture and is the accuracy truly limited in such an experiment to 10 ns?

I regret not posting the reference in the original question.

Regarding the GPS question, please ignore it as, rereading, it confuses even me.

I post on world building because, in my experience, if I posted od other forums, they would direct me here.

• What kind of logs are you talking? If you're asking about a specific log (e.g. syslog for *nix systems), please edit that into the question. If you're instead asking about the theoretical maximum precision of a logging system designed for that purpose, please edit the question to include the constraints on that system (e.g. do the logs have to be human-readable? do they have to be contiguous on disk? do they even have to go to disk, or can they just be in memory? etc.). – manveti Nov 12 '19 at 1:10
• What is the relationship between system logs and measuring the duration of time intervals? What do you mean by "GPS spatial precision for given time precision"? (Anyway, the accuracy of the timestamps of computer system logs varies quite a lot, depending on whether there is a requirement for the computer system in question to be synchronized with other computers or not. For web servers, for example, it is important to be not-very-much out of sync; for this reason web servers, and your Mac, run some sort of NTP client, and are generally synchronized to better than 10 msec most of time.) – AlexP Nov 12 '19 at 1:11
• x86 has included the RDTSC instruction since before the turn of the century. This performs cycle counting. Assuming a properly configured system (power saving disabled, proper fencing instructions used, no comparisons between multiple cores), this should measure time differences in the ~nanosecond ranges. Higher precision timers were made more recently, but it tells us something that "obsolete" is in the ns range. The precision of logs is generally limited more by the fact humans aren't really to concerned with super high precision. A millisecond is a while on a computer. – Zwuwdz Nov 12 '19 at 1:29
• @Zwuwdz: Cycle counting doesn't work all that well on virtual machines... It all depends on the intended application, something which the question doesn't disclose. – AlexP Nov 12 '19 at 1:31
• We deal with worldbuilding problems. Computers and their logs might be the topic of other SE community. – L.Dutch - Reinstate Monica Nov 12 '19 at 3:20

## 3 Answers

Precision is one thing -- it means how fine are the slices into which the logging system divides time. Accuracy is quite another thing -- it means how close to reality is the labeling of those slices. Most computers which are used as servers maintain very good accuracy, that is, when they say the time is 22:40:15 UTC they are rarely wrong by more than 10 milliseconds or so. But when they log events they may not bother to provide better than one second of precision, because it seldom needed.

• Unix/Linux servers which use syslog log events with a timestamp resolution of one second.

Nov 12 22:17:01 hostname CRON[4428]: (root) CMD ( ... --report /etc/cron.hourly)
Nov 12 22:36:30 hostname systemd[1]: Starting Clea...of Temporary Directories...
Nov 12 22:36:30 hostname systemd[1]: Started Clean...p of Temporary Directories.
Nov 12 22:39:00 hostname systemd[1]: Starting Clean php session files...
Nov 12 22:39:00 hostname systemd[1]: Started Clean php session files.
Nov 12 22:39:01 hostname CRON[4531]: (root) CMD ( ...r/lib/php/sessionclean; fi)

• Most web servers log requests with an timestamp resolution of one second. They could log events with higher timestamp resolution, but this is the default and it's rarely changed.

19-11-12 21:54:44 172.105.23.36 -/- 400 (0 sec) na.../1.1" from "-" with "-" - -
19-11-12 22:20:27 155.93.118.14 -/- 302 (0 sec) na...rtdavidgraham/masscan)" - -
19-11-12 23:08:05 185.128.41.50 -/- 404 (0 sec) xx..." with "Java/1.8.0_131" - -
19-11-12 23:27:15 176.65.252.77 -/- 302 (0 sec) xx...2743.116 Safari/537.36" - -
19-11-12 23:52:10 201.49.226.113 -/- 302 (0 sec) x...2704.103 Safari/537.36" - -
19-11-13 00:12:57 79.119.0.146 -/- 302 (0 sec) xxx.../1.0" from "-" with "-" - -

• Windows-based systems log events with a time resolution of one second. (The timestamp field of an event log record is 32 bits.)

Some systems write logs with higher resolution, but they are in a minority. Examples include database servers, or systems performing certain kinds of financial transactions.

To understand the problem you are facing, it is necessary to understand the difference between the physical capabilities of computer-systems (I will refer to everything with a processing chip as computer, so a Texas Instruments TI-30 is a computer).

While the physical precision that most timer-chips and processors can provide to a computer-system is in the nanosecond range. Even nowadays a huge amount of computer-systems still measures time intervals in mostly 10ms steps, and this is fine for most applications still.

You are talking about computer system logs in your question, I interpret this as the typical log information a typical computer system accumulates during its runtime, and in extension logs written by (consumer) softwares running on theses systems.

The time intervals and precision of such logs is highly dependent on the use-case they exist for and the environments these softwares run (yes, an operating system is also a software).

This stackoverflow answer is pretty good in regards to explaining the issue. Important for our understanding is this paragraph:

The following operating systems are known not to be able to use HPET: Windows XP, Windows Server 2003, and earlier Windows versions, older Linux versions

This might sound irrelevant to your use-case. But it is not. This really means that plenty of systems are guaranteed to not being able to have a higher accuracy/precision than ~10ms steps when measuring time.

As a programmer, I can personally tell you that dot_Sp0t's answer is accurate and right. To add a datapoint: most software written nowadays count date and time by considering some given date and tume as the "time 0" and then counting the milisseconds from there. Java, Javascript, C# and I believe most Python, Ruby and Perl will use such structures.

So in short, most computers, videogame consoles and handheld devices in the world will log things with a precision of milisseconds. Scientific instruments will have higher precision, bit I don't know the greatest accuracy they can reach.

• Precision and accuracy are different things. And most syslog logs of Unix/Linux servers in this world record events with a resolution of one second, anyway. (Try a tail /var/log/syslog on your server.) I don't know what is the resolution of systemd's journal. – AlexP Nov 12 '19 at 22:21