I have some audit logs with a date stamp of the format


what are the numbers after . and after : represent?

using a website epoch converter 1532400673 converts to GMT: Tuesday, July 24, 2018 2:51:13 AM

if I do date -d @1532400673 I get Mon Jul 23 22:51:13 EDT 2018

but trying to do date -d @1532400673.760:2358773 is invalid format.

  • .### is probably milliseconds the other digit I don't know. GMT and EDT are to different time and they are not the same explaning why you have two different date.
    – Kiwy
    Jul 25, 2018 at 14:43
  • 1
    which OS ? suse ? redhat ? which audit logs ?
    – Archemar
    Jul 25, 2018 at 14:44
  • 4
    .760 is likely to be milliseconds. :2358773 is likely not to be part of the timestamp. Without information as to what generates that audit log, it's hard to tell what it might be. Jul 25, 2018 at 14:44

1 Answer 1


If we dive the source code,

% rpm -qi audit | grep http
Packager    : CentOS BuildSystem <http://bugs.centos.org>
URL         : http://people.redhat.com/sgrubb/audit/
% git clone https://github.com/linux-audit/audit-userspace.git
% cd audit-userspace/

And then make a guess that the epoch is a %d flag to printf followed by a colon (it might also be a %ld or %u or %lu depending on whether long or unsigned is for some reason involved):

% grep -ri '%d:' . | tail -1
./auparse/test/auparse_test.py:            print("    event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)))

we find some test code that indicates the fields are second, millisecond, and some sort of event serial number. From additional digging it appears these values are grouped together as they all belong to a particular memory structure. Hopefully the docs will have more information about what that serial number is...

  • 1
    See the description of the -a option in ausearch man page. Jul 25, 2018 at 15:13
  • Usually in dmesg they are since boot time, no idea here. Jul 25, 2018 at 18:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .