# conn.log timestamps order of appearance
**URL:** https://community.zeek.org/t/conn-log-timestamps-order-of-appearance/6452
**Category:** Zeek
**Created:** [February 27, 2022, 6:27pm UTC](https://community.zeek.org/t/conn-log-timestamps-order-of-appearance/6452 "2022-02-27T18:27:17Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Tewodros\_Ambasa](https://community.zeek.org/u/Tewodros_Ambasa)
#### Post date: [February 27, 2022, 6:27pm UTC](https://community.zeek.org/t/conn-log-timestamps-order-of-appearance/6452/1 "2022-02-27T18:27:17Z")
Good Day
I have noticed while viewing the conn.log file, that some of the timestamp fields in the entries are not in chronological order. For example, viewing a section of this file I see:
2022-02-08T21:14:03+0200
2022-02-08T21:14:04+0200
2022-02-08T21:13:14+0200
2022-02-08T21:12:49+0200
2022-02-08T21:14:05+0200
Is this normal?
---
### Author:  [@Richard\_Bejtlich](https://community.zeek.org/u/Richard_Bejtlich)
#### Post date: [February 28, 2022, 3:03pm UTC](https://community.zeek.org/t/conn-log-timestamps-order-of-appearance/6452/2 "2022-02-28T15:03:13Z")
Yes, I think so – I see similar behavior:
$ zcat conn\_20220228\_14:00:00-15:00:00+0000.log.gz | head | jq -c ‘[."\_write\_ts", .“ts”]’
[“2022-02-28T14:00:00.918036Z”,“2022-02-28T13:59:50.851735Z”]
[“2022-02-28T14:00:00.918036Z”,“2022-02-28T13:59:50.882787Z”]
[“2022-02-28T14:00:01.136879Z”,“2022-02-28T13:59:50.227671Z”]
[“2022-02-28T14:00:05.285740Z”,“2022-02-28T13:59:55.285679Z”]
[“2022-02-28T14:00:05.385740Z”,“2022-02-28T13:59:55.299620Z”]
[“2022-02-28T14:00:05.410113Z”,“2022-02-28T14:00:00.262610Z”]
[“2022-02-28T14:00:05.912741Z”,“2022-02-28T13:59:55.912644Z”]
[“2022-02-28T14:00:06.692171Z”,“2022-02-28T13:59:50.861636Z”]
[“2022-02-28T14:00:07.129325Z”,“2022-02-28T13:59:57.096288Z”]
[“2022-02-28T14:00:07.467482Z”,“2022-02-28T14:00:01.992636Z”]
Sincerely,
Richard
---
### Author:  [@johanna](https://community.zeek.org/u/johanna)
#### Post date: [February 28, 2022, 3:08pm UTC](https://community.zeek.org/t/conn-log-timestamps-order-of-appearance/6452/3 "2022-02-28T15:08:42Z")
Hi Tewodros,
yes, this is indeed normal. The timestamp that is, e.g., given in conn.log is the timestamp at which the connection was created (timestamp of first packet). However, the log line is written after the connection terminates. Thus, it is expected, and completely normal, that the the timestamps will not be ordered chronologically.
I hope this helps,
Johanna
---
### Author:  [@Vern](https://community.zeek.org/u/Vern)
#### Post date: [February 28, 2022, 3:11pm UTC](https://community.zeek.org/t/conn-log-timestamps-order-of-appearance/6452/4 "2022-02-28T15:11:34Z")
> I have noticed while viewing the conn.log file, that some of the timestamp
> fields in the entries are not in chronological order.
This is routine. It happens because generating the log entry occurs upon completion of the connection (or in some cases a timeout), but the timestamp at the beginning is when the connection started, not when it was logged. Because connections have varying lengths, this leads to out-of-order start timestamps.
— Vern
---
### Author:  [@Sunil\_Thota](https://community.zeek.org/u/Sunil_Thota)
#### Post date: [March 3, 2022, 7:16am UTC](https://community.zeek.org/t/conn-log-timestamps-order-of-appearance/6452/5 "2022-03-03T07:16:58Z")
Can we change that to create a log using connection completion time ?
Anyone tried that before ? curious to know if that can be doable
---
### Author:  [@Vern](https://community.zeek.org/u/Vern)
#### Post date: [March 3, 2022, 4:29pm UTC](https://community.zeek.org/t/conn-log-timestamps-order-of-appearance/6452/6 "2022-03-03T16:29:02Z")
> Can we change that to create a log using connection completion time ?
Even if you did that (which doesn’t seem as useful as knowing the start time), logs would still likely be out-of-order, since some of the entries are driven off of network activity (i.e., right at the end of the connection) and others off of timeouts (in which case the actual end was in the past).
If you need the logs to be in order, the usual approach is simply to sort them on timestamp.
— Vern
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/conn-log-timestamps-order-of-appearance/6452/7 "2022-05-06T15:47:51Z")