how to get the core creation date

[Vishal Augustine]

From a coredump, how to get the date the core was generated. Has gdb got any option or should I write a small program to get the value ? Is there any other tool ? Does the core image has the value stored in its header ?

Thanks and Regards
Vishal

[Deepak Extross]

One way would be to write a small C program to print the ctime (creation time).
But be aware that this value can be modified by a user if he so desires.

[Juan Manuel López]

Use the " what " command to see more information about the core file.
I hope this help.

[Vishal Augustine]

I guess both won't get me the creation time.

Take the scenario where u have a coredump and u have ftped to another machine after a day. The ctime of the core will not reflect the true value. I don't think 'what' helps.

I reckon, we can get it from the data structures of the core header, if it stores the creation time there. I am searching the net to get the format.

Can any one help me ...

Thanks and Regards
Vishal

[Olav Baadsvik]

Hi,

Assuming that the core-file is from an
application, not from a system-panic,
I do not think you will find info about when
the core-file was generated in the core-file
itself.

man core
will give you some info about the format of
the file.
You will probably have to get the time-info
from the file-system where the core-file
was created.

Regards
Olav

[Paula J Frazer-Campbell]

Hi

I have just tried a

strings core | grep :

and the very last line displayed the time and date of the core dump.

strings core | grep "/2002"

does the same, but better.

Hth

Paula

[Vishal Augustine]

Olav,

Bad luck if they don't write tht info into the core. Correct me if I am wrong. HP execs follow the elf format ... right? So I shud be able to read the core if I know the elf structures. What do you think ? Checkout this site http://sources.redhat.com/ml/binutils/1999-10/msg00104.html

Paula, I tried that ... one problem here is - if it has some string tht has stored an older time (say I stored the time in a string when the program started and after 5 hours the program/server crashed), that will also come up. Or else there should be some field which says tht the creation time is so and so. Were u mentioning something like tht ?

Thanks and Regards
Visha

[Paula J Frazer-Campbell]

Hi

I would more than guess that the latest time within the file would be the time that the server wrote the contents of memory to the file?

Paula

[Olav Baadsvik]

Hi,
Sorry for the dealy - I have had lunch..
I must admit I do not know the details here.
But, yes HP uses the elf format for 64-bit
binaries.
But it must be the format of the core-file
that determins if you will find the time
for the core-file creation - not the elf-
format.
Remeber the core file is a core image of
a process - and I would think that not all
info found in the elf-objects that make up
the executable file is loaded into memory
by the loader when the the program is started.

Olav