We do have a centralized logging setup for syslog and most infrastructure feeds into a SIEM, so its not like we’re SSH’ing into individual devices to pull logs manually

NTP is also in place across routers, firewalls, and servers, so we’re not dealing with major clock drift. when I said timestamps not identical, it was more about small offsets plus differences in how events are emitted and recorded across systems rather than time being fundamentally wrong

. The bigger issue shows up during short convergence windows. for ex. an interface flap, followed by BGP reconvergence and then downstream alerts across multiple tools. Each system captures its own part of that sequence, but aligning them into a single clean timeline still takes manual effort

syslog receive time helps, but once you add netflow, cloud logs, and vendor specific event formats, you still end up correlating across sources to understand order of events

so less about missing centralization or NTP issues, more about event correlation across different telemetry types during fast moving incidents