Unix timestamps for incident response and log correlation

Unix time is commonly expressed as seconds since the UTC epoch, but application logs often use milliseconds, microseconds or nanoseconds. A 10-digit contemporary value is usually seconds and a 13-digit value is usually milliseconds, but length is only a heuristic. Confirm the field's documentation and retain the raw value.

Converting with the wrong unit can produce a date near 1970 or thousands of years away. Do not silently divide or multiply until the result looks plausible; record the assumed unit and why it is justified.

Use an ISO 8601 representation with a Z suffix for the normalized UTC time. If an operator reported a local time, retain the original text and the timezone identifier or numeric offset that applied at that date. Abbreviations such as CST are ambiguous, and daylight-saving transitions can make a local clock time occur twice or not at all.

A sound evidence table includes the raw timestamp, source system, unit, normalized UTC value, original timezone context and conversion method. This makes the transformation reviewable rather than presenting a converted date as unquestionable fact.

raw=1784203200123
unit=milliseconds
source=api-gateway
utc=2026-07-16T12:00:00.123Z

Two logs with precise timestamps can still describe clocks that disagree. Capture time-synchronization status, known drift and ingestion delay where available. A central logging platform may timestamp receipt rather than the original event, so inspect the schema instead of assuming every field represents occurrence time.

When the uncertainty windows overlap, avoid claiming a strict order. State that the events were concurrent within the available clock accuracy and look for causal identifiers such as request IDs, sequence numbers or message offsets.

• Distinguish event time from collection or ingestion time.
• Preserve sub-second precision supplied by the source.
• Record clock synchronization and known drift.
• Use correlation IDs alongside time ordering.

Timestamps can become sensitive when paired with usernames, internal hosts or incident details. Convert only the field needed and avoid copying complete log lines into generic tools. DailyITTools can convert a numeric value locally, but the operator remains responsible for minimizing surrounding data.

In the final timeline, distinguish source evidence, normalized values and analyst inference. This preserves the chain of reasoning and makes later corrections possible if a source clock is found to have been wrong.