Hold up, has anyone looked at the system clock itself? What if the server time drifted? The log might say 2 AM, but the actual failure could have been at like 1:50. I've seen that happen where the logs are all lined up but the clock was just wrong. Makes the whole timestamp argument useless.