Howard Chu wrote:
Time values are based on the time(3) subroutine, which can also be affected by anyone explicitly resetting the system clock. Of course, such an event would also be visible on regular syslog timestamps etc.
If someone manages to muck with this on a production system one has likely more serious issues than a monitoring check. ;-)
Ciao, Michael.