easyMultiple Choice
350-401 Practice Question: An engineer notices that syslog messages from a…
An engineer notices that syslog messages from a Cisco router are not timestamped correctly. The router is configured with 'service timestamps log datetime msec' and 'logging host 10.1.1.1'. The syslog server shows messages with the correct time but the local logs on the router show incorrect timestamps. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the distinction between the router's local timestamp (which depends on its clock) and the syslog server's receipt timestamp, leading candidates to mistakenly think the server overwrites the timestamp or that the command is unsupported.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The router's system clock is not synchronized via NTP or manual setting.
The 'service timestamps log datetime msec' command tells the router to include a timestamp in syslog messages, but the timestamp is derived from the router's system clock. If the clock is not synchronized via NTP or manually set, the local logs will show incorrect timestamps. The syslog server, however, receives the messages and applies its own timestamp upon receipt, which is why the server shows the correct time. Therefore, the mismatch is caused by the router's unsynchronized clock.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The 'service timestamps log datetime msec' command is not supported on this platform.
Why it's wrong here
This command is a standard, long-supported global configuration command on Cisco IOS and IOS-XE routers. Its absence would only cause timestamps to be missing, not incorrect, and the problem explicitly states that logs have 'incorrect' timestamps. Therefore, the platform support premise is false and cannot be the cause of the issue.
- ✓
The router's system clock is not synchronized via NTP or manual setting.
Why this is correct
Syslog messages generated on the router itself are stamped with the router's system clock before being written to local logs. If the clock is not synchronized via NTP or has not been manually set correctly, every log entry will carry the wrong date and time. This directly matches the symptom of incorrect local log timestamps, making it the correct root cause.
- ✗
The syslog server is overwriting the timestamps.
Why it's wrong here
When a router sends a syslog message to a remote server, the server typically adds its own reception timestamp to the stored record, but it cannot modify the timestamp field that the router embedded in the message itself. The question specifically refers to 'local logs' on the router, which are generated and stored locally without any server involvement. Since the server never touches local logs, it cannot be overwriting timestamps in that scenario.
- ✗
The 'logging host' command must include the 'transport tcp' option.
Why it's wrong here
The `logging host` command does support an optional transport protocol (UDP, TCP, or TLS), but that choice only affects the delivery mechanism of the syslog packet. The timestamp inside the message is created by the router based on its system clock before the transport layer is even involved. Changing the transport to TCP would not alter the timestamp value in any way, so this option would not fix incorrect local timestamps.
Go deeper
Related to this question
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.