Re: [Crash-utility] Question about timestampt output for "sys"
----- "James Washer" <washer(a)trlp.com> wrote:
The time is aware of MY timezone (easily tested).. but I'd still
not
sure if is the time of the panic... or some later time
On Mon, 2009-03-30 at 12:08 -0700, James Washer wrote:
> If I run 'sys', I see timestamps such as
> DATE: Thu Mar 26 08:53:13 2009
>
> What "time" is this.. the time the panic occurred? The time the dump was
> "collected"? Is it Zulu timeszone, is it my (the crash investigators)
> time zone, is it the timezone of the system that crashed?
It's a ctime() translation of the contents of the kernel's "xtime"
timespec
structure. So running on a live system, you can see it change.
On a dumpfile, that's a good question, because thinking about it, it may have
slightly different meanings depending upon the dumpfile-creation mechanism used.
So, for example, on a netdump or diskdump it's whatever was last there when the
kernel memory containing the data structure was copied to disk or over the
network. With a kdump, it would still be getting bumped up until the point
where the kernel transitions/kexec's into the secondary kernel, right?
Anyway, it's *somewhere* around the time of the panic...
Dave