There's still the problem if what if you're looking at a log after a system restarted/crashed. Do you have the previous start time logged somewhere? Personally

There's still the problem if what if you're looking at a log after a system restarted/crashed. Do you have the previous start time logged somewhere? Personally, while I appreciate your arguments, I'm not sold on them.