Wandering Thoughts archives

What the timestamps in Ubuntu kernel messages mean

Ubuntu kernels are configured so that they include cryptic time information in kernel messages. An example looks like:

[8804849.737776] Kernel BUG at fs/nfs/file.c:321

(In the general tradition of Linux kernel messages, this is just enough to show you that there is useful stuff present without actually giving you any clear idea of how to interpret it to get actual information.)

It turns out that the timestamp is seconds and microseconds since the system booted. If the system is still running, the simple way to relate it to wall clock time is to look at /proc/uptime to get the current number of seconds since the system booted and subtract the difference to get the wall clock time. ('date -d "now - NNN seconds"' may be useful here.)

(If the system is not still running you will have to work forward from its boot time, which hopefully got recorded somewhere. I believe that adjusting the system clock does not adjust the 'seconds since boot' counters; beware of this if you had to make significant time adjustments to your system.)

This configuration setting is controlled by the kernel config option PRINTK_TIME. Well, sort of. The config option sets the default value for this setting, which you can override in two ways:

• at boot time, with 'printk.time=1' (or 0, depending on preferences; 'y', 'Y', 'n', and 'N' are also accepted)
• dynamically, by writing a suitable value to /sys/module/printk/parameters/time.

(I got this information from here.)