This is used for internal purpose, to expire (after 5 min) cached audit record which is stuck inside trace_context , since no record of EOE type received for audit_event_id.

@npamnani Oh I see, but it’s still saved as the event’s timestamp right? The milliseconds part is the number after the dot:

1501323932.710:7670542

, i.e. 710. How can we get that number for event?