----- "James Washer" <washer(a)trlp.com&gt; wrote: It's a ctime() translation of the contents of the kernel's "xtime" timespec structure. So running on a live system, you can see it change. On a dumpfile, that's a good question, because thinking about it, it may have slightly different meanings depending upon the dumpfile-creation mechanism used. So, for example, on a netdump or diskdump it's whatever was last there when the kernel memory containing the data structure was copied to disk or over the network. With a kdump, it would still be getting bumped up until the point where the kernel transitions/kexec's into the secondary kernel, right? Anyway, it's *somewhere* around the time of the panic... Dave