[systemd-devel] Timestamps in journal during suspend/resume

[Mantas Mikulėnas]

On Tue, Dec 1, 2020 at 1:46 PM Paul Menzel <
pmenzel+systemd-devel at molgen.mpg.de> wrote:

>
> At least to me, some of the entries with timestamps from resuming should
> have timestamps from suspending. Is the reason, that “suspend message“
> was only written to the journal after resume?
>

Probably because the journald process (like all other userspace processes)
had already been frozen when those messages were written to dmesg, so it
couldn't really receive them.


>
> Is there a way to access the Linux kernel timestamp from within the
> journal?
>

Yes, as the _SOURCE_MONOTONIC_TIMESTAMP field. (It's stored in
microseconds, while dmesg shows it in seconds.)

journalctl -o json _TRANSPORT=kernel | jq -r
'"[\(._SOURCE_MONOTONIC_TIMESTAMP | tonumber / 1000000)] \(.MESSAGE)"'

Note that the kernel uses the monotonic clock for dmesg messages, which
does not advance at all while the system is suspended -- so trying to
convert it to realtime will often give wrong results (the same problem as
in 'dmesg -e') unless you do something smart with combining it with
journald's __REALTIME_TIMESTAMP.

-- 
Mantas Mikulėnas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20201201/0a6f9ecf/attachment.htm>