[Crash-utility] Question about timestampt output for "sys"
Dave Anderson
anderson at redhat.com
Mon Mar 30 20:40:16 UTC 2009
----- "James Washer" <washer at trlp.com> wrote:
> The time is aware of MY timezone (easily tested).. but I'd still not
> sure if is the time of the panic... or some later time
>
> On Mon, 2009-03-30 at 12:08 -0700, James Washer wrote:
> > If I run 'sys', I see timestamps such as
> > DATE: Thu Mar 26 08:53:13 2009
> >
> > What "time" is this.. the time the panic occurred? The time the dump was
> > "collected"? Is it Zulu timeszone, is it my (the crash investigators)
> > time zone, is it the timezone of the system that crashed?
It's a ctime() translation of the contents of the kernel's "xtime" timespec
structure. So running on a live system, you can see it change.
On a dumpfile, that's a good question, because thinking about it, it may have
slightly different meanings depending upon the dumpfile-creation mechanism used.
So, for example, on a netdump or diskdump it's whatever was last there when the
kernel memory containing the data structure was copied to disk or over the
network. With a kdump, it would still be getting bumped up until the point
where the kernel transitions/kexec's into the secondary kernel, right?
Anyway, it's *somewhere* around the time of the panic...
Dave
More information about the Crash-utility
mailing list