move the timestamps from the shm into the syscall records
remove no longer needed includes