What does a timestamp in a log actually prove?¶

It proves that a system associated a time value with an event field. How closely that value represents the real-world activity depends on its clock, stage, zone and precision.

Different fields describe different moments¶

Device, server, application, collector and monitoring clocks may record start, end, write, receipt, ingestion or display. Clocks can be wrong, unsynchronised or manually changed, and whole-second precision can hide ordering within a second.

Preserve meaning before conversion¶

Identify system and field creator, event stage, format, zone, offset and precision. Retain the original and document any conversion. Compare important times with other records and reliable references.

Use “system-recorded” or approximate wording where accuracy is not established rather than presenting unsupported exactness.