Cisco ASA Syslog Showing Wrong Time? How to Fix Logging Timestamps

Scenario:
Make: Cisco
Model: Cisco ASA 5500-X series [ASA 5506-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X etc.]
Version: ASA 9.x or later, ASDM 7.x or later
Mode: CLI and GUI [ASDM]
Description: In this article, we will discuss how to fix Cisco ASA syslog and logging messages that show the wrong time, or a different time from the ASA clock. We will check the clock and NTP, enable logging timestamps, and fix time zone differences with the syslog server.

Problem

Sometimes the time on syslog or logging messages, in ASDM, in the CLI or on your syslog server, does not match the time set on the ASA, even though the firewall clock looks correct. The ASA keeps logging, but with a different or wrong timestamp, which makes troubleshooting and security investigations very difficult.

In the example below, the ASA clock shows 23 March 2023, but the log messages are stamped 24 November 2022:

Nov 24 2022 06:23:23 edledge-asa %ASA-5-746015: user-identity: [FQDN] download.windowsupdate.com resolved 8.253.150.254
Nov 24 2022 06:23:23 edledge-asa %ASA-5-746015: user-identity: [FQDN] download.windowsupdate.com resolved 8.247.119.254
Nov 24 2022 06:23:23 edledge-asa %ASA-5-746014: user-identity: [FQDN] download.windowsupdate.com address 104.98.115.136 obsolete
Nov 24 2022 06:23:23 edledge-asa %ASA-3-746016: user-identity: DNS lookup for wustat.windows.com failed, reason:Timeout or unresolvable

edledge-asa# show clock
08:43:05.852 IST Thu Mar 23 2023

Common Causes

Cause	Symptom	Fix
Logging timestamp is disabled	Messages have no ASA time; the viewer or syslog server adds its own time	Fix 2
ASA clock or NTP not in sync	ASA clock is wrong or drifting	Fix 1
Wrong time zone on the ASA	Logs are off by a fixed number of hours	Fix 1
Syslog server uses a different time zone	Logs look correct on the ASA but are shifted on the server	Fix 3
Old messages still in the log buffer	Only old dates appear in show logging	Fix 4

Fix 1: Check the ASA Clock, Time Zone and NTP

Connect to the ASA over SSH and check the clock and NTP status:

edledge-asa# show clock detail
edledge-asa# show ntp status
edledge-asa# show ntp associations

show ntp status should report Clock is synchronized. If it does not, or the time zone is wrong, set them, for example for India Standard Time (UTC +5:30):

edledge-asa# configure terminal
edledge-asa(config)# clock timezone IST 5 30
edledge-asa(config)# ntp server 192.168.1.10 prefer
edledge-asa(config)# exit

Replace the NTP server IP with your own. For more detail on NTP, see Network Time Protocol.

Fix 2: Enable Logging Timestamps

If logging timestamps are disabled, the ASA sends syslog messages without its own time, and whatever receives them adds a time of its own. Enabling timestamps makes every message carry the ASA’s time.

CLI Method

Step 1: Enable the Timestamp
Enter configuration mode and enable logging timestamps:

edledge-asa# configure terminal
edledge-asa(config)# logging timestamp
edledge-asa(config)# exit

Step 2: Save the Configuration

edledge-asa# write memory
Building configuration...
Cryptochecksum: 845e144f f45e143e 945e144f 945e144f

3384 bytes copied in 0.170 secs
[OK]

GUI Method (ASDM)

Step 1: Log In to ASDM
Open ASDM and log in to the ASA.

Step 2: Open Syslog Setup
Go to “Configuration” > “Device Management” > “Logging” > “Syslog Setup”.

Step 3: Enable the Timestamp
Tick “Include timestamp in syslogs”. In newer ASDM versions, you can also choose the timestamp format.

Step 4: Apply and Save
Click “Apply”, then “Save”.

Fix 3: Match the Time Zone with Your Syslog Server

By default, the ASA timestamp does not include a time zone. If your syslog server or SIEM runs in a different time zone, such as UTC, the messages can appear shifted by several hours. You can either set both the ASA and the server to the same time zone, or, on ASA 9.10 and later, use the RFC 5424 timestamp format, which includes the time zone offset:

edledge-asa(config)# logging timestamp rfc5424

Check that your syslog server supports RFC 5424 timestamps before changing the format.

Fix 4: Clear Old Messages from the Buffer

The internal log buffer can still contain messages from before the fix, which makes it look as if the problem persists. Clear it to see only new messages:

edledge-asa# clear logging buffer

Verify the Fix

edledge-asa# show running-config logging
edledge-asa# show clock
edledge-asa# show logging

The running configuration should include logging timestamp, and new messages in show logging should carry the same date and time as show clock. Also check that new messages on your syslog server show the correct time.

Frequently Asked Questions

Why do my ASA logs show the wrong time?

Usually because logging timestamps are disabled, the ASA clock or NTP is not synchronised, the time zone is wrong, or the syslog server uses a different time zone.

Does “logging timestamp” affect firewall performance?

No. Adding a timestamp to each message has no noticeable impact on performance.

Do I need to configure this on both firewalls in a failover pair?

No. In an Active/Standby pair, configuration changes on the active unit are copied to the standby unit automatically. Make sure both units reach the NTP server.

To learn more about the different logging destinations, see Cisco ASA Firewall Logging/Syslog Types & Configuration [GUI].

Disclaimer: This article is for educational purposes only and is not professional financial, medical, or legal advice. It may contain affiliate links, which earn us a small commission at no extra cost to you. See our Disclaimer and Affiliate Disclosure.

Article ID: EA00136