Cisco IOS Log Asterisk Timestamp Meaning
IP Services
Why would a log file contain a * next to the date?
Answer
Correct answer: C — The network device is not configured to use NTP.
Community Insight
The asterisk signifies a lack of authoritative time source (NTP not configured), whereas a dot indicates loss of sync with an already-configured NTP server.
This question explains the significance of the asterisk (*) prefix in Cisco IOS log timestamps, indicating that NTP is not configured and the system clock has never been synchronized. It distinguishes this state from other timestamp indicators like dots or blank spaces.
Many learners confuse the asterisk (*) with a dot (.), incorrectly selecting that the device lost contact with an NTP server instead of recognizing that NTP is simply not configured at all.
Community Discussion (42 comments)
Jcap
👍 1
Selected: B
Asterisk (*): An asterisk before a syslog timestamp indicates that the system time is not authoritative. This means the device's clock has not been synchronized with a reliable external time source (like an NTP server) and has not been set manually. If a device boots up and cannot reach its configured NTP server, it will prepend an asterisk to its logs.
Rowdy_47
👍 1
Selected: B
B. The network device was unable to reach the NTP server when the log messages were recorded.
tiago_rs84
👍 1
Selected: B
The correct answer is B, in Cisco IOS operating systems, the symbols preceding the data and time in the logs (timestamps) indicate the reliability and time source of the device.
studyguy42
👍 1
Selected: B
On many Cisco devices, a * (asterisk) next to the timestamp in a log message indicates that the system time is not yet synchronized, usually due to the device not yet receiving time from an NTP server. The asterisk is a visual cue that the time shown may not be accurate. This often happens right after a reboot or during network issues preventing NTP sync.
Reavr
👍 2
Selected: B
Answer is B. Tested in lab. I configured the NTP server and made sure the switch could reach the ntp server, no asterisk in the logs. I then rebooted the switch and looked at the logs, there was an asterisk while the switch was still coming up. Once the VLAN came up and it could reach the ntp server again, the asterisk went away.
ferdomravec87
👍 2
Your test is flawed. When switch is booting up, I has NOT loaded the startup conifig to the memory yet so you have because it is still technically NOT configured for NTP. Create a network outage between the switch and NTP and you will see you get ' . ' to the logs, not
7bd74d9
👍 1
Selected: C
Answer is C. After configuring NTP server the logging disappeared. Make sure that the time is synchronized with NTP otherwise it will still show the on the log. R2#show ntp status Clock is synchronized, stratum 2, reference is 194.58.207.148 R2(config)#int lo0 R2(config-if)#no sh R2(config-if)#end R2# Jun 28 18:56:21.769: %SYS-5-CONFIG_I: Configured from console by console Jun 28 18:56:23.295: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up Jun 28 18:56:23.296: %LINK-3-UPDOWN: Interface Loopback0, changed state to up
VLAN4461
👍 3
Asterisk():- If the system clock has not been set, the date and time are preceded by an asterisk (), which indicates that the date and time have not been set and should be verified. dot (.):- The dot means the router has gone out of sync with its configured NTP server and therefore the date/time may be incorrect. https://community.cisco.com/t5/switching/what-does-the-and-mean-at-the-beginning-of-a-log-buffer-entry/td-p/2494471
sonjad
👍 2
I think D is correct. is not related to ntp server settings at all. It just says that time was not configured by admin. As soon as I set clock manually, "" disappeared in logs. It happens without any ntp config.
sonjad
👍 2
I've changed my mind. It's true that "C" is not accurate enough. "" means that the time is not set and might be not accurate. And you can clear "" by setting time not only using NTP but also manually. Nevertheless "D" looks even less suitable for me now. Default time stamps format would not cause "*". It's just a format after all https://community.cisco.com/t5/switching/what-does-the-and-mean-at-the-beginning-of-a-log-buffer-entry/td-p/2494471
massimp
👍 5
Selected: C
C is correct. Tried in real lab with a device previously connected to NTP server : ASR1002-X#sh ntp status Clock is synchronized, stratum 4, reference is 192.168.0.12 ASR1002-X#conf t Enter configuration commands, one per line. End with CNTL/Z. ASR1002-X(config)#no ntp server 192.168.0.12 .May 13 15:02:06.514: %SYS-5-CONFIG_I: Configured from console by vty0 (10.61.104.185) So, it's not B.
Chiaretta
👍 3
Selected: C
C is correct. At the moment of log receving the NTP was non configured. If would show a dot at the moment of log receving NTP was not in sync
JackDRipper
👍 4
Selected: C
An asterisk "*" before the timestamp points to answer C as the reason. A period/dot "." before the timestamp points to answer B.
HungarianDish_111
👍 4
Selected: C
https://www.cisco.com/c/en/us/td/docs/routers/xr12000/software/xr12k_r3-9/system_management/command/reference/yr39xr12k_chapter4.html The system clock keeps an “authoritative” flag that indicates whether the time is authoritative (believed to be accurate). If the system clock has been set by a timing source, such as system calendar (CLI) or Network Time Protocol (NTP), the flag is set. If the time is not authoritative, it is used only for display. * Time is not authoritative. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/bsm/configuration/15-2mt/bsm-time-calendar-set.html Within the CLI command syntax, the hardware clock is referred to as the system calendar.
HungarianDish_111
👍 3
same here: https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_clock.htm
dragonwise
👍 7
Selected: B
I have tested it in a lab and the answer is B
Clauster
👍 2
Selected: B
Answer is B Check out CCIE answer https://community.cisco.com/t5/switching/what-does-the-and-mean-at-the-beginning-of-a-log-buffer-entry/td-p/2494471
x3rox
👍 5
Cisco IOS Configuration Fundamentals Command Reference: ASTERISK * - Time is not authoritative: the software clock is not in sync or has never been set. BLANK - Time is authoritative: the software clock is in sync or has just been set manually. DOT . - Time is authoritative, but NTP is not synchronized: the software clock was in sync, but has since lost contact with all configured NTP servers.
x3rox
👍 1
source: https://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_s2.html#wp1486074
olaniyijt
👍 1
If nothing is before the date, it means that your router clock was set manually or is in sync with a NTP server by the time of the log. If with an asterisk, it means you didn't set the clock or it isn't synced with a NTP server. If there's a period, it means the clock was in sync but the NTP server is not accessible. https://networkengineering.stackexchange.com/questions/10168/interpreting-cisco-logging-symbols#:~:text=If%20nothing%20is%20before%20the,synced%20with%20a%20NTP%20server.
gordon888
👍 2
Selected: B
B. The network device was unable to reach the NTP server when the log messages were recorded. Most accurate in lab: //刚起机，配置正确ntp但ntp没学到时间时： //When the machine is just started and ntp is configured correctly, but ntp has not learned the time: Jan 28 02:03:50.603: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up 000020: Jan 28 2023 10:03:50 bj: %SYS-6-CLOCKUPDATE: System clock has been updated from 02:03:50 UTC Sat Jan 28 2023 to 10:03:50 bj Sat Jan 28 2023, configured from console by console. 000021: Jan 28 2023 10:03:51 bj: %SSH-5-DISABLED: SSH 1.99 has been disabled 000022: Jan 28 2023 10:03:55 bj: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
Rose66
👍 5
Selected: C
I will go for C: If the system clock has not been set, the date and time are preceded by an asterisk (*) to indicate that the date and time are probably not correct.
kewokil120
👍 1
Selected: B
I like B. I have a cisco switch that normally does not show and it configured with NTP. During an issue window the appeared in it logs.
rogi2023
👍 1
great lab-work. (*) is printed when NTP is not configured on the device. (.) is printed when NTP is configured, device was once in synced, but now can't reach the NTP server. But what is the diff between answer C and D ?? IMHO they are saying the same..only D is more precise/specific.
markymark874
👍 3
Selected: C
The datetime keyword adds time stamps in the format mmm dd hh:mm:ss, indicating the date and time according to the system clock. If the system clock has not been set, the date and time are preceded by an asterisk (*), which indicates that the date and time have not been set and should be verified.
nushadu
👍 1
I've changed my mind - C. sw2# *Jan 6 16:57:25.810: %SYS-5-CONFIG_I: Configured from console by console <<<<<<<<<<<< sw2#show ntp associations sw2#show ntp stat %NTP is not enabled. sw2#
dnjJ56
👍 13
Selected: C
(*) is printed when NTP is not configured on the device. (.) is printed when NTP is configured, device was once in synced, but now can't reach the NTP server. C is the correct Answer. Tested in the lab.
kg2280
👍 1
answer is B. If you configured NTP, but you cannot reach the NTP server, you will have the As soon as the switch can reach the NTP server, the will disappear. Also tested in lab
cjk3
👍 1
Selected: D
https://community.cisco.com/t5/network-security/what-does-asterisk-mean-in-show-clock/td-p/1644594
nushadu
👍 1
#sh logg Dec 27 16:13:15.659: %BGP-5-NBR_RESET: Neighbor 192.168.255.55 passive reset (BGP Notification sent) Dec 27 16:13:15.659: %BGP-5-ADJCHANGE: neighbor 192.168.255.55 passive Down AFI/SAFI not supported Dec 27 16:13:23.893: %BGP-5-ADJCHANGE: neighbor 192.168.255.55 Up Dec 27 16:13:33.385: %TRACK-6-STATE: 3 ip route 5.5.5.5/32 reachability Down -> Up Dec 27 16:13:33.385: %TRACK-6-STATE: 4 ip route 5.5.5.55/32 reachability Down -> Up <<<<< asterisks in the logs cisco_R3# show ntp associations address ref clock st when poll reach delay offset disp ~1.1.1.1 .INIT. 16 - 1024 0 0.000 0.000 15937. <<<<<<<<<<< fail to connect to NTP serv. sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured cisco_R3#show running-config | s ntp ntp server 1.1.1.1 prefer cisco_R3#
nushadu
👍 1
sw1#show run | section ntp ntp logging ntp server 0.pl.pool.ntp.org prefer sw1#show run | section name ip name-server 8.8.8.8 ip name-server 8.8.4.4 sw1# Translating "0.pl.pool.ntp.org"...domain server (8.8.8.8) [OK] Dec 21 09:32:55.348: NTP Core (INFO): 213.199.225.30 8014 84 reachable Dec 21 09:32:55.348: NTP Core (INFO): 213.199.225.30 962A 8A sys_peer Dec 21 09:32:55.348: NTP Core (NOTICE): trans state : 5 Dec 21 09:32:55.348: NTP Core (NOTICE): Clock is synchronized. sw1# sw1# sw1#conf Configuring from terminal, memory, or network [terminal]? Enter configuration commands, one per line. End with CNTL/Z. sw1(config)#^Z sw1# sw1# Dec 21 09:39:48.375: %SYS-5-CONFIG_I: Configured from console by console <<<<<<<<< no asterics sw1#
nushadu
👍 1
Selected: B
after setup NTP server the asterisk disappeared from the logs begin of the line: #sh log ... Dec 20 22:10:02.892: %SYS-5-CONFIG_I: Configured from console by console Dec 20 22:11:48.253: NTP Core (INFO): keys initilized. Dec 20 22:11:48.258: NTP Core (NOTICE): proto: precision = usec Dec 20 22:11:48.258: NTP Core (NOTICE): ntpd PPM Dec 20 22:11:48.287: NTP Core (INFO): 162.159.200.123 8014 84 reachable Dec 20 22:11:48.287: NTP Core (INFO): 162.159.200.123 902D 8D popcorn popcorn Dec 20 22:11:50.285: NTP Core (INFO): 162.159.200.123 963A 8A sys_peer Dec 20 22:11:50.285: NTP Core (NOTICE): trans state : 5 Dec 20 22:11:50.285: NTP Core (NOTICE): Clock is synchronized. Dec 20 22:12:17.604: %SYS-5-CONFIG_I: Configured from console by console Dec 20 22:14:00.611: %IDBMAN-4-ACTIVEPORTSINAGGPORT: Port-channel1( 16 / 1 ) has -1136578896 active ports, but is being removed Dec 20 22:14:06.164: %SYS-5-CONFIG_I: Configured from console by console sw1#
nushadu
👍 1
sw1#show ntp associations address ref clock st when poll reach delay offset disp ~162.159.200.123 10.73.8.213 3 1 64 377 19.936 -4.785 3.160 sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured sw1# sw1#show ntp status Clock is synchronized, stratum 4, reference is 162.159.200.123 nominal freq is 250.0000 Hz, actual freq is 250.0001 Hz, precision is 2**10 ntp uptime is 81700 (1/100 of seconds), resolution is 4000 reference time is E74CB4D0.49374C90 (22:25:20.286 UTC Tue Dec 20 2022) clock offset is -4.7850 msec, root delay is 43.72 msec root dispersion is 9.22 msec, peer dispersion is 3.16 msec loopfilter state is 'CTRL' (Normal Controlled Loop), drift is -0.000000339 s/s system poll interval is 64, last update was 5 sec ago. sw1#
Xerath
👍 2
Selected: B
I really think it's "B".
KOJJY
👍 2
Selected: B
the closet answer from cisco community
mikinet
👍 2
Selected: C
"Network device is not configured to use NTP" is the only answer which may justify the fact that system clock has not been set and thus date and time are preceded by an asterisk (*),
DUBC89x
👍 1
If the system clock has not been set, the date and time are preceded by an asterisk (*), which indicates that the date and time have not been set and should be verified. https://community.cisco.com/t5/switching/what-does-the-and-mean-at-the-beginning-of-a-log-buffer-entry/td-p/2494471#:~:text=If%20the%20system%20clock%20has,set%20and%20should%20be%20verified.
tckoon
👍 1
Selected: D
D is correct. This question taken from Cisco community https://community.cisco.com/t5/switching/what-does-the-and-mean-at-the-beginning-of-a-log-buffer-entry/td-p/2494471#:~:text=If%20the%20system%20clock%20has,set%20and%20should%20be%20verified.
Deu_Inder
👍 2
Vague question. Noth the links provided below are the same. The only meaningful info from the link is: "If the system clock has not been set, the date and time are preceded by an asterisk (*) to indicate that the date and time are probably not correct." And there can be many reasons why the date and time of the device are not correct.
jucevabe
👍 1
Selected: D
https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/service_timestamps.htm
jj970us
👍 3
Selected: B
Reference: https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/service_timestamps.htm
H3kerman
👍 1
according to your link: If the system clock has not been set, the date and time are preceded by an asterisk (*) to indicate that the date and time are probably not correct. It means D
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is C because in Cisco IOS, an asterisk (*) preceding a timestamp indicates that the system clock is not authoritative, typically meaning NTP is not configured and the clock has never been set manually. This is a standard behavior for devices relying on the internal boot clock without external synchronization.Why the Other Options Are Wrong
Option A is incorrect because receiving NTP time results in a clean timestamp without a prefix. Option B describes a scenario where NTP is configured but unreachable, which produces a dot (.) prefix, not an asterisk. Option D is incorrect because the presence of the asterisk specifically denotes the lack of a time source configuration, not just the logging setting.Community Comment Notes
Community consensus strongly supports option C, with multiple users verifying this behavior in lab environments. As user dnjJ56 noted, "() is printed when NTP is not configured on the device," while a dot appears if the device was previously synced but lost contact. User x3rox clarified the distinction: "ASTERISK - Time is not authoritative... BLANK - Time is authoritative... DOT. - Time is authoritative, but NTP is not synchronized." Official Cisco documentation confirms that the asterisk indicates the time has not been set by a timing source such as NTP or CLI.Official Reference
Exam Strategy
Memorize the specific symbols used in Cisco IOS timestamps: asterisk (*) means no time source, dot (.) means out of sync with configured NTP, and blank means synchronized. Recognizing these visual cues is critical for troubleshooting time-related issues in logs.
Frequently Asked Questions
What does a dot (.) mean in a Cisco log timestamp?
A dot indicates NTP is configured but the device has lost synchronization with the server.
How do I fix an asterisk (*) in my log timestamps?
Configure an NTP server using 'ntp server <ip>' or set the time manually via CLI.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →