Cisco IOS Log Asterisk Timestamp Meaning

350-401 By islever Editorial Last updated

IP Services

Short answer

C The network device is not configured to use NTP.

Question

Why would a log file contain a * next to the date?
  1. The network device was receiving NTP time when the log messages were recorded.
  2. The network device was unable to reach the NTP server when the log messages were recorded.
  3. The network device is not configured to use NTP. Correct Answer
  4. The network device is not configured to use NTP time stamps for logging.

Key Takeaways

The asterisk signifies a lack of authoritative time source (NTP not configured), whereas a dot indicates loss of sync with an already-configured NTP server.

This question explains the significance of the asterisk (*) prefix in Cisco IOS log timestamps, indicating that NTP is not configured and the system clock has never been synchronized. It distinguishes this state from other timestamp indicators like dots or blank spaces.

Common mistake: Many learners confuse the asterisk (*) with a dot (.), incorrectly selecting that the device lost contact with an NTP server instead of recognizing that NTP is simply not configured at all.

Expert Analysis

Why the Answer Is Correct

The correct answer is C because in Cisco IOS, an asterisk (*) preceding a timestamp indicates that the system clock is not authoritative, typically meaning NTP is not configured and the clock has never been set manually. This is a standard behavior for devices relying on the internal boot clock without external synchronization.

Why the Other Options Are Wrong

Option A is incorrect because receiving NTP time results in a clean timestamp without a prefix. Option B describes a scenario where NTP is configured but unreachable, which produces a dot (.) prefix, not an asterisk. Option D is incorrect because the presence of the asterisk specifically denotes the lack of a time source configuration, not just the logging setting.

Community Comment Notes

Community consensus strongly supports option C, with multiple users verifying this behavior in lab environments. As user dnjJ56 noted, "() is printed when NTP is not configured on the device," while a dot appears if the device was previously synced but lost contact. User x3rox clarified the distinction: "ASTERISK - Time is not authoritative... BLANK - Time is authoritative... DOT. - Time is authoritative, but NTP is not synchronized." Official Cisco documentation confirms that the asterisk indicates the time has not been set by a timing source such as NTP or CLI.

Official Reference

https://www.cisco.com/c/en/us/td/docs/routers/xr12000/software/xr12k_r3-9/system_management/command/reference/yr39xr12k_chapter4.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the specific symbols used in Cisco IOS timestamps: asterisk (*) means no time source, dot (.) means out of sync with configured NTP, and blank means synchronized. Recognizing these visual cues is critical for troubleshooting time-related issues in logs.

Frequently Asked Questions

What does a dot (.) mean in a Cisco log timestamp?

A dot indicates NTP is configured but the device has lost synchronization with the server.

How do I fix an asterisk (*) in my log timestamps?

Configure an NTP server using 'ntp server <ip>' or set the time manually via CLI.

More 350-401 FAQ →

Discussion 42 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 42

  1. dnjJ56 👍 13 Answered C
    (*) is printed when NTP is not configured on the device. (.) is printed when NTP is configured, device was once in synced, but now can't reach the NTP server. C is the correct Answer. Tested in the lab.
  2. dragonwise 👍 7 Answered B
    I have tested it in a lab and the answer is B
  3. x3rox 👍 5
    Cisco IOS Configuration Fundamentals Command Reference: ASTERISK * - Time is not authoritative: the software clock is not in sync or has never been set. BLANK - Time is authoritative: the software clock is in sync or has just been set manually. DOT . - Time is authoritative, but NTP is not synchronized: the software clock was in sync, but has since lost contact with all configured NTP servers.
  4. massimp 👍 5 Answered C
    C is correct. Tried in real lab with a device previously connected to NTP server : ASR1002-X#sh ntp status Clock is synchronized, stratum 4, reference is 192.168.0.12 ASR1002-X#conf t Enter configuration commands, one per line. End with CNTL/Z. ASR1002-X(config)#no ntp server 192.168.0.12 .May 13 15:02:06.514: %SYS-5-CONFIG_I: Configured from console by vty0 (10.61.104.185) So, it's not B.
  5. Rose66 👍 5 Answered C
    I will go for C: If the system clock has not been set, the date and time are preceded by an asterisk (*) to indicate that the date and time are probably not correct.
Show 25 more comments
  1. HungarianDish_111 👍 4 Answered C
    https://www.cisco.com/c/en/us/td/docs/routers/xr12000/software/xr12k_r3-9/system_management/command/reference/yr39xr12k_chapter4.html The system clock keeps an “authoritative” flag that indicates whether the time is authoritative (believed to be accurate). If the system clock has been set by a timing source, such as system calendar (CLI) or Network Time Protocol (NTP), the flag is set. If the time is not authoritative, it is used only for display. * Time is not authoritative. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/bsm/configuration/15-2mt/bsm-time-calendar-set.html Within the CLI command syntax, the hardware clock is referred to as the system calendar.
  2. JackDRipper 👍 4 Answered C
    An asterisk "*" before the timestamp points to answer C as the reason. A period/dot "." before the timestamp points to answer B.
  3. VLAN4461 👍 3
    Asterisk():- If the system clock has not been set, the date and time are preceded by an asterisk (), which indicates that the date and time have not been set and should be verified. dot (.):- The dot means the router has gone out of sync with its configured NTP server and therefore the date/time may be incorrect. https://community.cisco.com/t5/switching/what-does-the-and-mean-at-the-beginning-of-a-log-buffer-entry/td-p/2494471
  4. markymark874 👍 3 Answered C
    The datetime keyword adds time stamps in the format mmm dd hh:mm:ss, indicating the date and time according to the system clock. If the system clock has not been set, the date and time are preceded by an asterisk (*), which indicates that the date and time have not been set and should be verified.
  5. Chiaretta 👍 3 Answered C
    C is correct. At the moment of log receving the NTP was non configured. If would show a dot at the moment of log receving NTP was not in sync
  6. jj970us 👍 3 Answered B
    Reference: https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/service_timestamps.htm
  7. HungarianDish_111 👍 3
    same here: https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_clock.htm
  8. gordon888 👍 2 Answered B
    B. The network device was unable to reach the NTP server when the log messages were recorded. Most accurate in lab: //刚起机，配置正确ntp但ntp没学到时间时： //When the machine is just started and ntp is configured correctly, but ntp has not learned the time: Jan 28 02:03:50.603: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up 000020: Jan 28 2023 10:03:50 bj: %SYS-6-CLOCKUPDATE: System clock has been updated from 02:03:50 UTC Sat Jan 28 2023 to 10:03:50 bj Sat Jan 28 2023, configured from console by console. 000021: Jan 28 2023 10:03:51 bj: %SSH-5-DISABLED: SSH 1.99 has been disabled 000022: Jan 28 2023 10:03:55 bj: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
  9. sonjad 👍 2
    I've changed my mind. It's true that "C" is not accurate enough. "" means that the time is not set and might be not accurate. And you can clear "" by setting time not only using NTP but also manually. Nevertheless "D" looks even less suitable for me now. Default time stamps format would not cause "*". It's just a format after all https://community.cisco.com/t5/switching/what-does-the-and-mean-at-the-beginning-of-a-log-buffer-entry/td-p/2494471
  10. Deu_Inder 👍 2
    Vague question. Noth the links provided below are the same. The only meaningful info from the link is: "If the system clock has not been set, the date and time are preceded by an asterisk (*) to indicate that the date and time are probably not correct." And there can be many reasons why the date and time of the device are not correct.
  11. Reavr 👍 2 Answered B
    Answer is B. Tested in lab. I configured the NTP server and made sure the switch could reach the ntp server, no asterisk in the logs. I then rebooted the switch and looked at the logs, there was an asterisk while the switch was still coming up. Once the VLAN came up and it could reach the ntp server again, the asterisk went away.
  12. ferdomravec87 👍 2
    Your test is flawed. When switch is booting up, I has NOT loaded the startup conifig to the memory yet so you have because it is still technically NOT configured for NTP. Create a network outage between the switch and NTP and you will see you get ' . ' to the logs, not
  13. sonjad 👍 2
    I think D is correct. is not related to ntp server settings at all. It just says that time was not configured by admin. As soon as I set clock manually, "" disappeared in logs. It happens without any ntp config.
  14. mikinet 👍 2 Answered C
    "Network device is not configured to use NTP" is the only answer which may justify the fact that system clock has not been set and thus date and time are preceded by an asterisk (*),
  15. Clauster 👍 2 Answered B
    Answer is B Check out CCIE answer https://community.cisco.com/t5/switching/what-does-the-and-mean-at-the-beginning-of-a-log-buffer-entry/td-p/2494471
  16. KOJJY 👍 2 Answered B
    the closet answer from cisco community
  17. Xerath 👍 2 Answered B
    I really think it's "B".
  18. nushadu 👍 1 Answered B
    after setup NTP server the asterisk disappeared from the logs begin of the line: #sh log ... Dec 20 22:10:02.892: %SYS-5-CONFIG_I: Configured from console by console Dec 20 22:11:48.253: NTP Core (INFO): keys initilized. Dec 20 22:11:48.258: NTP Core (NOTICE): proto: precision = usec Dec 20 22:11:48.258: NTP Core (NOTICE): ntpd PPM Dec 20 22:11:48.287: NTP Core (INFO): 162.159.200.123 8014 84 reachable Dec 20 22:11:48.287: NTP Core (INFO): 162.159.200.123 902D 8D popcorn popcorn Dec 20 22:11:50.285: NTP Core (INFO): 162.159.200.123 963A 8A sys_peer Dec 20 22:11:50.285: NTP Core (NOTICE): trans state : 5 Dec 20 22:11:50.285: NTP Core (NOTICE): Clock is synchronized. Dec 20 22:12:17.604: %SYS-5-CONFIG_I: Configured from console by console Dec 20 22:14:00.611: %IDBMAN-4-ACTIVEPORTSINAGGPORT: Port-channel1( 16 / 1 ) has -1136578896 active ports, but is being removed Dec 20 22:14:06.164: %SYS-5-CONFIG_I: Configured from console by console sw1#
  19. nushadu 👍 1
    #sh logg Dec 27 16:13:15.659: %BGP-5-NBR_RESET: Neighbor 192.168.255.55 passive reset (BGP Notification sent) Dec 27 16:13:15.659: %BGP-5-ADJCHANGE: neighbor 192.168.255.55 passive Down AFI/SAFI not supported Dec 27 16:13:23.893: %BGP-5-ADJCHANGE: neighbor 192.168.255.55 Up Dec 27 16:13:33.385: %TRACK-6-STATE: 3 ip route 5.5.5.5/32 reachability Down -> Up Dec 27 16:13:33.385: %TRACK-6-STATE: 4 ip route 5.5.5.55/32 reachability Down -> Up <<<<< asterisks in the logs cisco_R3# show ntp associations address ref clock st when poll reach delay offset disp ~1.1.1.1 .INIT. 16 - 1024 0 0.000 0.000 15937. <<<<<<<<<<< fail to connect to NTP serv. sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured cisco_R3#show running-config | s ntp ntp server 1.1.1.1 prefer cisco_R3#
  20. nushadu 👍 1
    sw1#show ntp associations address ref clock st when poll reach delay offset disp ~162.159.200.123 10.73.8.213 3 1 64 377 19.936 -4.785 3.160 sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured sw1# sw1#show ntp status Clock is synchronized, stratum 4, reference is 162.159.200.123 nominal freq is 250.0000 Hz, actual freq is 250.0001 Hz, precision is 2**10 ntp uptime is 81700 (1/100 of seconds), resolution is 4000 reference time is E74CB4D0.49374C90 (22:25:20.286 UTC Tue Dec 20 2022) clock offset is -4.7850 msec, root delay is 43.72 msec root dispersion is 9.22 msec, peer dispersion is 3.16 msec loopfilter state is 'CTRL' (Normal Controlled Loop), drift is -0.000000339 s/s system poll interval is 64, last update was 5 sec ago. sw1#
  21. nushadu 👍 1
    sw1#show run | section ntp ntp logging ntp server 0.pl.pool.ntp.org prefer sw1#show run | section name ip name-server 8.8.8.8 ip name-server 8.8.4.4 sw1# Translating "0.pl.pool.ntp.org"...domain server (8.8.8.8) [OK] Dec 21 09:32:55.348: NTP Core (INFO): 213.199.225.30 8014 84 reachable Dec 21 09:32:55.348: NTP Core (INFO): 213.199.225.30 962A 8A sys_peer Dec 21 09:32:55.348: NTP Core (NOTICE): trans state : 5 Dec 21 09:32:55.348: NTP Core (NOTICE): Clock is synchronized. sw1# sw1# sw1#conf Configuring from terminal, memory, or network [terminal]? Enter configuration commands, one per line. End with CNTL/Z. sw1(config)#^Z sw1# sw1# Dec 21 09:39:48.375: %SYS-5-CONFIG_I: Configured from console by console <<<<<<<<< no asterics sw1#
  22. 7bd74d9 👍 1 Answered C
    Answer is C. After configuring NTP server the logging disappeared. Make sure that the time is synchronized with NTP otherwise it will still show the on the log. R2#show ntp status Clock is synchronized, stratum 2, reference is 194.58.207.148 R2(config)#int lo0 R2(config-if)#no sh R2(config-if)#end R2# Jun 28 18:56:21.769: %SYS-5-CONFIG_I: Configured from console by console Jun 28 18:56:23.295: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up Jun 28 18:56:23.296: %LINK-3-UPDOWN: Interface Loopback0, changed state to up
  23. olaniyijt 👍 1
    If nothing is before the date, it means that your router clock was set manually or is in sync with a NTP server by the time of the log. If with an asterisk, it means you didn't set the clock or it isn't synced with a NTP server. If there's a period, it means the clock was in sync but the NTP server is not accessible. https://networkengineering.stackexchange.com/questions/10168/interpreting-cisco-logging-symbols#:~:text=If%20nothing%20is%20before%20the,synced%20with%20a%20NTP%20server.
  24. DUBC89x 👍 1
    If the system clock has not been set, the date and time are preceded by an asterisk (*), which indicates that the date and time have not been set and should be verified. https://community.cisco.com/t5/switching/what-does-the-and-mean-at-the-beginning-of-a-log-buffer-entry/td-p/2494471#:~:text=If%20the%20system%20clock%20has,set%20and%20should%20be%20verified.
  25. studyguy42 👍 1 Answered B
    On many Cisco devices, a * (asterisk) next to the timestamp in a log message indicates that the system time is not yet synchronized, usually due to the device not yet receiving time from an NTP server. The asterisk is a visual cue that the time shown may not be accurate. This often happens right after a reboot or during network issues preventing NTP sync.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What is a primary characteristic of traffic shaping?

S-grade

What is a Key Characteristic of Cisco vManage?

S-grade

What Is Achieved by This Python NETCONF XML Parsing Code?

S-grade

How to Configure VTY Lines for Idle Session Termination

S-grade

Practice All 350-401 Questions

Access 218 questions with complete answers and detailed explanations.

View Full 350-401 Practice Test →

← Back to 350-401 Study Guide