In line with the possibility of your system’s clock actually being wrong, can you correlate some other events in your logs to when you know they occurred? What about inside your VMs and CTs?