If you have messages in dmesg that log the event time as “seconds since last boot”, it can be difficult to tell when they happened. Here’s an example of one of these messages:
# tail -1 /var/log/dmesg
[8969653.483175] poorcoding.php[14798]: segfault at 7f2efca36ed0 ip 00007f2efca36ed0 sp 00007f2efaf0be98 error 14
#You could use something like this to parse out the timestamp and convert it to a date:
# date --date=@$((`date +%s --date="\`who -b | awk '{print $3" "$4}'\`"` + `dmesg | tail -1 | awk '{print $1}' | sed -e 's/\[//g' -e 's/\..*//g'`))
Thu Nov 5 01:21:53 PDT 2015
#If your application logs to kern.log, it uses timestamps as well as seconds since uptime, so the error will already have a timestamp on it
Aug 14 09:57:59 myhostname kernel: [8969653.483177] poorcoding.php[14800]: segfault at 7f2efca36ec8 ip 00007f2efca36ec8 sp 00007f2ef10c4e98 error 14TODO: make a quick function; convert all the messages not just a tailed or greped one;
dmesg -T ?
Thanks for the reply. I used this method because I was working on an older system.
Here’s a one-liner to parse the whole dmesg output:
while IFS='[].’ read junk ts tms msg; do echo “$ts $msg”; done < <(dmesg) | awk '{$1=strftime("%Y-%m-%d %H:%M:%S",($1+'$boottime'))"\t"; print}'