Depending on the configuration, Linux event timestamps may not include the year. To deduce the correct year for back-filled events, the last modified timestamp is used as a starting point. This is a best effort to determine the correct year for the events. It may not be accurate in all cases.
Back-filled events timestamp
- Published on Sep 11, 2026
- 1 minute(s) read
Was this article helpful?
Related articles
- Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.2.0 > Module overview > Logon data sources
- Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.1.9 > Module Overview > Logon Data Sources
- Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Searching your enterprise > Search token reference > Token reference
- Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.1.9 > Module Overview > Logon Data Sources