topic Re: how to get the core creation date in Operating System - HP-UX

how to get the core creation date

Vishal Augustine — Tue, 18 Jun 2002 05:15:42 GMT

From a coredump, how to get the date the core was generated. Has gdb got any option or should I write a small program to get the value ? Is there any other tool ? Does the core image has the value stored in its header ?

Thanks and Regards
Vishal

Re: how to get the core creation date

Deepak Extross — Tue, 18 Jun 2002 05:43:52 GMT

One way would be to write a small C program to print the ctime (creation time).
But be aware that this value can be modified by a user if he so desires.

Re: how to get the core creation date

Juan Manuel López — Tue, 18 Jun 2002 06:09:42 GMT

Use the " what " command to see more information about the core file.
I hope this help.

Re: how to get the core creation date

Vishal Augustine — Tue, 18 Jun 2002 07:35:09 GMT

I guess both won't get me the creation time.

Take the scenario where u have a coredump and u have ftped to another machine after a day. The ctime of the core will not reflect the true value. I don't think 'what' helps.

I reckon, we can get it from the data structures of the core header, if it stores the creation time there. I am searching the net to get the format.

Can any one help me ...

Thanks and Regards
Vishal

Re: how to get the core creation date

Olav Baadsvik — Tue, 18 Jun 2002 08:04:21 GMT

Hi,

Assuming that the core-file is from an
application, not from a system-panic,
I do not think you will find info about when
the core-file was generated in the core-file
itself.

man core
will give you some info about the format of
the file.
You will probably have to get the time-info
from the file-system where the core-file
was created.

Regards
Olav

Re: how to get the core creation date

Paula J Frazer-Campbell — Tue, 18 Jun 2002 08:13:39 GMT

Hi

I have just tried a

strings core | grep :

and the very last line displayed the time and date of the core dump.

strings core | grep "/2002"

does the same, but better.

Hth

Paula

Re: how to get the core creation date

Vishal Augustine — Tue, 18 Jun 2002 09:03:42 GMT

Olav,

Bad luck if they don't write tht info into the core. Correct me if I am wrong. HP execs follow the elf format ... right? So I shud be able to read the core if I know the elf structures. What do you think ? Checkout this site http://sources.redhat.com/ml/binutils/1999-10/msg00104.html

Paula, I tried that ... one problem here is - if it has some string tht has stored an older time (say I stored the time in a string when the program started and after 5 hours the program/server crashed), that will also come up. Or else there should be some field which says tht the creation time is so and so. Were u mentioning something like tht ?

Thanks and Regards
Visha

Re: how to get the core creation date

Paula J Frazer-Campbell — Tue, 18 Jun 2002 09:22:16 GMT

Hi

I would more than guess that the latest time within the file would be the time that the server wrote the contents of memory to the file?

Paula

Re: how to get the core creation date

Olav Baadsvik — Tue, 18 Jun 2002 10:34:02 GMT

Hi,
Sorry for the dealy - I have had lunch..
I must admit I do not know the details here.
But, yes HP uses the elf format for 64-bit
binaries.
But it must be the format of the core-file
that determins if you will find the time
for the core-file creation - not the elf-
format.
Remeber the core file is a core image of
a process - and I would think that not all
info found in the elf-objects that make up
the executable file is loaded into memory
by the loader when the the program is started.

Olav