Comparing timestamps from logs on one timeline

Preserve each raw timestamp, identify its format and unit, then convert every event to UTC for ordering. A ten-digit epoch value is often seconds; a thirteen-digit one is often milliseconds, but verify against a known event.

Keep the source time zone and any clock-skew uncertainty in your notes. Daylight-saving changes can make local times repeat or disappear, so do not sort mixed local strings directly. Compare only the events relevant to the same request or incident.

Which formats do the logs use?