By default the time related settings are not usable by any standards. Even if the clock is set manually by using the command:
Router#clock set 20:30:00 October 01 2007
There is little accomplished by just setting the time. For starters, the default configuration of a Cisco device is to mark all log entries based on the uptime of the device. So, a log entry under these default settings would look like:
10:01:18: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console
This entry says that the interface counters were cleared at the point when the device had been up (booted) for 10 hours, 01 minute, and 18 seconds. In order to then calculate this very confusing equation: You must look at the current uptime of the device (show version), then subtract the amount of time in the log entry. The result means the entry was logged that amount of time ago from the current (real) time.
Full walk through of calculating the example log entry above:
Step1:
Router#show version Router uptime is 12 hours 10 minutes
Step2:
(12 hours 10 minutes) - (10 hours 01 minute) = 2 hours 9 minutes
So approx. two hours and nine minutes ago the interface counters were cleared
Step3:
If the current, real time was 10:30 p.m. then the counters would have been cleared at approximately 8:21 p.m.
In order to cease this madness, configure the Cisco device with the following logging statements:
Router(config)#service timestamps debug datetime Router(config)#service timestamps log datetime
Assuming the clock was set along with the timestamp configuration above, the log entries now look like:
*Oct 2 21:56:00: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console
This is a vast improvment over the default method and requires zero calculation to determine when the entry was logged.


Print This Post