Mickey Everts wrote:
How is it possible to have out of order time stamps? My first thought would be that somehow the device itself is sending the timestamp.
That is the fact. The syslog entry contains the time from the source generating the syslog message.
Aug 2 15:11:24 ap01.yipes.com KERN: NV:Completed configuration save (secondary) operation Aug 2 15:10:47 t3-0-2-0.jp02.yipes.com mgd[13087]: UI_JUNOSCRIPT_ERROR: junoscript error: syntax error, expecting <command> Aug 2 15:11:26 t3-0-2-0.jp02.yipes.com mgd[13087]: UI_CMDLINE_READ_LINE: user 'auser', command 'start shell '
In this case, the time on ap01.yipes.com is ahead of that on t3-0-2-0.jp02.yipes.com. The best way to fix this is to run NTP (Network Time Protocol) on all of the servers; I recommend appointing one machine to be ntp.yipes.com, synchronizing it to some Internet NTP server, and let your entire company synchronize to ntp.yipes.com.