42

I have (for example) this log entry in dmesg output:

[600711.395348] do_trap: 6 callbacks suppressed

Is there a possibility to convert this 'dmesg' time to 'real' time to know, when this event happend?

59

It looks as if it was implemented recently for Quantal (12.10) : see http://brainstorm.ubuntu.com/idea/17829/ .

Basically, dmesg is reported to have a new switch -T, --ctime.


Edit. As another extension on Ignacio's answer, here are some scripts to enhance dmesg output on older systems.

( Note: for the python version of the code shown there, one will want to replace &lt; and &gt; back to <> to make it usable again. )


Finally, for a single value like 600711.395348 one could do

ut=`cut -d' ' -f1 </proc/uptime` 
ts=`date +%s` 
date -d"70-1-1 + $ts sec - $ut sec + 600711.395348 sec" +"%F %T"

and get the event date and time.

( Please note that due to round-off errors the last second digit probably won't be accurate. ) .

Edit(2): Please note that -- as per Womble's comment below, -- this will only work if the machine was not hibernated etc. ( In that case, one shall better look at syslog configs at /etc/*syslog* and check the appropriate files. See also: dmesg vs /var/messages . )

  • 4
    And, as an added bonus, if the machine's ever been suspended, you're completely doomed, because the time spent asleep isn't accounted for. – womble Sep 2 '15 at 23:28
  • Womble's comment is super imporant! It will show the wrong time if using a laptop that hibernates or is set in standby. You should use the /var/log/kern.log file to see the actual file. – oligofren Jan 8 '18 at 9:28
  • One-liner: date -d"1970-01-01 + $(date +%s) sec - $(cut -d' ' -f1 </proc/uptime) sec + 600711.395348 sec" +"%F %T.%N %Z" – kgibm Nov 13 '18 at 20:34
  • Note: I can no longer edit my comment, but instead of %Z, it should be UTC, since date +%s returns seconds since UTC. It would then have to be converted to the local time zone. – kgibm Nov 13 '18 at 20:41
  • 1
    @kgibm : I agree with (2) ; as for (1), it is not that I have anything against one-liners -- but I don't actually see a point for it here: code above is intentionally split in three lines for readability ( I need people to understand how it works, not make it as compact as possible ; for that, I shall better build it up sequentially ) and size ( I would love to have longer variable names, but that makes line 3 look nightmare-ish ); on the other hand, you probably won't type in the whole long line in a terminal, but rather put it in a file and make executable -- so no big win here either. – ジョージ Nov 14 '18 at 5:42
17

To extend on Ignacio's answer, the entries contained in dmesg are typically also logged elsewhere on the system, via syslog, which will give you a "real" timestamp. Unless Ubuntu have changed the Debian-set default, the log entries should be in /var/log/kern.log.

  • 1
    On Cent OS 5 and 6, the log entry is in /var/log/messages. – emerino Nov 25 '15 at 19:07
11

The time given in dmesg is in seconds since kernel startup. So, just add that many seconds to when the kernel started running (hint: uptime).

  • 1
    That will only work if you are using a system that never goes into standby. Otherwise you need to use the logs. – oligofren Jan 8 '18 at 9:29
3

I know this is now old but dmesg now has a built in -e or --reatime option to display the time in the local time.

root@bbs:/var/log# dmesg|tail -1
[50755952.379177] Out of memory in UB 1593: OOM killed process 3183 (sbbs) score 0 vm:747204kB, rss:242764kB, swap:88224kB

root@bbs:/var/log# dmesg -e|tail -1
[Feb20 17:10] Out of memory in UB 1593: OOM killed process 3183 (sbbs) score 0 vm:747204kB, rss:242764kB, swap:88224kB
2

On busybox, the 3 liner above didn't work, so here is my way to calculate it one off (replace 1628880.0 with your dmesg timestamp):

perl -e '@a=split(`/proc/uptime`);print scalar(localtime(time()+$a[0] - 1628880.0)."\n");'
2

dmesg | perl -pe 'use Unix::Uptime; s/^\[(.*)\]/localtime(time()-Unix::Uptime->uptime()+$1)/e'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.