Keep log timestamps in UTC
Servers in several zones, logs with UTC, with CST, and with local time and no offset. Half an hour of an incident went into lining up timestamps.
The rule is simple: store UTC, display local. Write ISO 8601 with Z or +00:00 and let tools convert.
2026-04-09T03:12:44Z level=error ...
You get sortable strings, no mental arithmetic across zones, and no repeated or missing hour at a DST boundary.
The cost is subtracting eight hours in your head — or just running journalctl --utc, or TZ=UTC in the terminal.
Databases deserve the same care: timestamp with time zone and timestamp are different types, one stores UTC and the other a wall clock. Mixing them always ends badly.