Logs and timelines: event meaning before chronology

Mechanism

Timeline analysis combines events whose clocks, timestamp formats, and meanings differ. An access log can record request arrival, completion, or application-defined time. A file timestamp may describe metadata change rather than content change. Build an explicit interpretation for each source before sorting everything into one sequence.

Practical method

Normalize timestamps to UTC while retaining original values and timezone assumptions. Identify clock drift and coarse resolution. Correlate stable identifiers such as request IDs, process IDs plus start times, or file hashes. Separate observed events from inferred causal links.

from datetime import datetime, timezone
t = datetime.fromisoformat("2026-10-12T14:03:00+02:00")
print(t.astimezone(timezone.utc).isoformat())

Interpreting evidence

A strong correlation uses more than close timestamps. Record the identifier and the expected delay between events, then test alternate explanations such as retries, buffered writes, or duplicated log ingestion.

Pitfalls and limits

Naive timestamps have no timezone. Daylight-saving transitions can repeat local times. Missing logs may reflect rotation or collection gaps; absence alone does not prove an event never happened.