On Sat, 19 Jan 2019 18:40:14 -0500 Nowakowski Media <johnnybanks604(a)gmail.com&gt; wrote: I am not sure I understand what you asking about. The audit system has used the same numbering technique for at least 14 years. Maybe you are referring to this: audit(1520664214.224:39242) In this time stamp we have 3 fields. To the left of the period is seconds since 1970. Just to the right is millisecond within the seconds since 1970. The last field after the colon is the serial number. The serial number is used to group all records that are part of the same event. There can be multiple events within the same millisecond so this serial number also serves to differentiate other events withing the same millisecond. At last, to make things more complicated, there is nothing in the kernel that serializes the events. So, the stream that comes out of the kernel and even written to disk can have 2 or more events with interlaced records. The userspace utilities have to be aware of this and reassemble the events correctly. Hopefully I have given some background about how the time stamp is used. Does this help? If not, could you explain your comment in a little more detail? Thanks, -Steve