Time sanitization of network logs from a geographically distributed computer system

A non-transitory computer-readable storage medium having computer program instructions stored thereon, the computer program instructions being executable by a host computer as a preprocessor to perform a method of creating a set of time correction records usable in applying corrections to timestamps of network logs to identify the timing of network events in a predetermined time reference frame, the network logs being created by and received from respective logging devices generating the timestamps in respective device time reference frames, the method including:

• by the host computer for each logging device, generating one or more network events at respective event times in the predetermined time reference frame, each network event being observed by a respective logging device and known to have a corresponding event-related network log (i) generated by the respective logging device and (ii) having a respective timestamp in a device time reference frame of the logging device;
• by the host computer for each of the network events, (i) receiving a respective network log from the respective logging device, and (ii) calculating a respective difference value as a difference between the respective event time and the timestamp of the respective network log of the respective logging device;
• and
• by the host computer for each logging device, applying a selection function to the difference values of the respective network events to calculate a correction value, and storing the correction value along with an identifier of the logging device in a corresponding time correction record,
• wherein generating one or more network events for the logging device includes generating network activity requiring processing by a network device whose network activity is logged in the network logs generated by the logging device, and wherein applying the selection function for each logging device includes selecting the respective calculated difference value as the correction value.