Howard Chu wrote:
Time values are based on the time(3) subroutine, which can also be
anyone explicitly resetting the system clock. Of course, such an event would
also be visible on regular syslog timestamps etc.
If someone manages to muck with this on a production system one has likely more
serious issues than a monitoring check. ;-)