63

I have (for example) this log entry in dmesg output:

[600711.395348] do_trap: 6 callbacks suppressed

Is there a possibility to convert this 'dmesg' time to 'real' time to know, when this event happend?

2

7 Answers 7

89

It looks as if it was implemented recently for Quantal (12.10) : see http://brainstorm.ubuntu.com/idea/17829/ .

Basically, dmesg is reported to have a new switch -T, --ctime.


Edit. As another extension on Ignacio's answer, here are some scripts to enhance dmesg output on older systems.

( Note: for the python version of the code shown there, one will want to replace &lt; and &gt; back to <> to make it usable again. )


Finally, for a single value like 600711.395348 one could do

ut=`cut -d' ' -f1 </proc/uptime` 
ts=`date +%s` 
date -d"70-1-1 + $ts sec - $ut sec + $(date +%:::z) hour + 600711.395348 sec" +"%F %T"

and get the event date and time in the local time zone.

( Please note that due to round-off errors the last second digit probably won't be accurate. ) .

Edit(2): Please note that -- as per Womble's comment below, -- this will only work if the machine was not hibernated etc. ( In that case, one shall better look at syslog configs at /etc/*syslog* and check the appropriate files. See also: dmesg vs /var/messages . )

8
  • 6
    And, as an added bonus, if the machine's ever been suspended, you're completely doomed, because the time spent asleep isn't accounted for.
    – womble
    Sep 2, 2015 at 23:28
  • 1
    Womble's comment is super imporant! It will show the wrong time if using a laptop that hibernates or is set in standby. You should use the /var/log/kern.log file to see the actual file.
    – oligofren
    Jan 8, 2018 at 9:28
  • One-liner: date -d"1970-01-01 + $(date +%s) sec - $(cut -d' ' -f1 </proc/uptime) sec + 600711.395348 sec" +"%F %T.%N %Z"
    – kgibm
    Nov 13, 2018 at 20:34
  • 1
    @kgibm : I agree with (2) ; as for (1), it is not that I have anything against one-liners -- but I don't actually see a point for it here: code above is intentionally split in three lines for readability ( I need people to understand how it works, not make it as compact as possible ; for that, I shall better build it up sequentially ) and size ( I would love to have longer variable names, but that makes line 3 look nightmare-ish ); on the other hand, you probably won't type in the whole long line in a terminal, but rather put it in a file and make executable -- so no big win here either. Nov 14, 2018 at 5:42
  • 1
    To add to @womble and oligofren great comments, a good practice can be running "journalctl -k" to see the correct time. For ones who are willing to match a specific phrase, "journalctl -k phrase" can be used. (replace "phrase" with the phrase you're searching for) Credit to 16851556 who answer this here: How do I convert dmesg timestamp to custom date format?
    – Oz Edri
    Feb 8 at 9:40
20

To extend on Ignacio's answer, the entries contained in dmesg are typically also logged elsewhere on the system, via syslog, which will give you a "real" timestamp. Unless Ubuntu have changed the Debian-set default, the log entries should be in /var/log/kern.log.

1
  • 1
    On Cent OS 5 and 6, the log entry is in /var/log/messages.
    – emerino
    Nov 25, 2015 at 19:07
11

The time given in dmesg is in seconds since kernel startup. So, just add that many seconds to when the kernel started running (hint: uptime).

1
  • 1
    That will only work if you are using a system that never goes into standby. Otherwise you need to use the logs.
    – oligofren
    Jan 8, 2018 at 9:29
6

I know this is now old but dmesg now has a built in -e or --reatime option to display the time in the local time.

root@bbs:/var/log# dmesg|tail -1
[50755952.379177] Out of memory in UB 1593: OOM killed process 3183 (sbbs) score 0 vm:747204kB, rss:242764kB, swap:88224kB

root@bbs:/var/log# dmesg -e|tail -1
[Feb20 17:10] Out of memory in UB 1593: OOM killed process 3183 (sbbs) score 0 vm:747204kB, rss:242764kB, swap:88224kB
1
2

On busybox, the 3 liner above didn't work, so here is my way to calculate it one off (replace 1628880.0 with your dmesg timestamp):

perl -e '@a=split(`/proc/uptime`);print scalar(localtime(time()+$a[0] - 1628880.0)."\n");'
2

dmesg | perl -pe 'use Unix::Uptime; s/^\[(.*)\]/localtime(time()-Unix::Uptime->uptime()+$1)/e'

0
0

Also in need of this for MacOS.

Ventura's dmesg has only 2 parameters :

dmesg [-M core] [-N system]

1
  • If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review
    – fission
    Mar 3, 2023 at 8:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .