What time do the auditd timestamps represent?