We are seeing a 40 - 45 second difference when the event\error is reported in Introscope vs. what is reported on the server.log on the application server. For example, the transaction shows up at 04:00 PM on the server.log with an exception, however in Introscope it shows up at 03:59:15 as error snapshot. We have ensured that the system time and Agent time are in sync.
Why is there a discrepancy between times reported by Agent Error Snapshot vs. Application logs ?
There is no discrepancy and in fact Agent is reporting the same times(approximately) as you are seeing in logs for the exception.
The TimeStamp field visible in the Historical Query viewer for the error snapshot that is being referred to, indicates the time at which root component of the transaction monitored by Introscope Agent started inside JVM NOT the transaction finish time.
The Duration value that you see in the Stack View for Error Snapshot is the actual time at which point the agent saw an error inside the monitored code and thus reported a error snapshot. Consequently, both fields i.e. TimeStamp and Duration need to be added to determine at which point trace event occurred to correlate with Application server logs.
You can also find more details on various column values seen in Transaction Trace Viewer at below link: