[Crash-utility] Question about timestampt output for "sys"

[Dave Anderson]

----- "James Washer" <washer at trlp.com> wrote:

> The time is aware of MY timezone (easily tested).. but I'd still not
> sure if is the time of the panic... or some later time
> 
> On Mon, 2009-03-30 at 12:08 -0700, James Washer wrote:
> > If I run 'sys', I see timestamps such as
> > 			   DATE: Thu Mar 26 08:53:13 2009
> > 
> > What "time" is this.. the time the panic occurred? The time the dump was
> > "collected"? Is it Zulu timeszone, is it my (the crash investigators)
> > time zone, is it the timezone of the system that crashed?

It's a ctime() translation of the contents of the kernel's "xtime" timespec
structure.  So running on a live system, you can see it change.  

On a dumpfile, that's a good question, because thinking about it, it may have
slightly different meanings depending upon the dumpfile-creation mechanism used. 
So, for example, on a netdump or diskdump it's whatever was last there when the
kernel memory containing the data structure was copied to disk or over the
network.  With a kdump, it would still be getting bumped up until the point
where the kernel transitions/kexec's into the secondary kernel, right?

Anyway, it's *somewhere* around the time of the panic...

Dave