First audit message, audit initialization, on aarch64, has zero-second timestamp. The msec counter appears to be running. It appears audit is initialized before the system clock.
Ex:
audit: type=2000 audit(0.360:1): state=initialized audit_enabled=0 res=1
audit: type=1403 audit(1692710902.940:3): auid=4294967295 ses=4294967295 lsm=selinux res=1
audit: type=1305 audit(1692710990.312:85): op=set audit_enabled=1 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
Expected results:
The problem was discovered because logwatch does not match these lines, expecting more digits in the parentheses. This assumption works elsewhere but not on aarch64.