[systemd-devel] Timestamps in journal during suspend/resume

[Mantas Mikulėnas]

On Tue, Dec 1, 2020 at 2:31 PM Mantas Mikulėnas <grawity at gmail.com> wrote:

> On Tue, Dec 1, 2020 at 1:46 PM Paul Menzel <
> pmenzel+systemd-devel at molgen.mpg.de> wrote:
>
>>
>> At least to me, some of the entries with timestamps from resuming should
>> have timestamps from suspending. Is the reason, that “suspend message“
>> was only written to the journal after resume?
>>
>
> Probably because the journald process (like all other userspace processes)
> had already been frozen when those messages were written to dmesg, so it
> couldn't really receive them.
>
>
>>
>> Is there a way to access the Linux kernel timestamp from within the
>> journal?
>>
>
> Yes, as the _SOURCE_MONOTONIC_TIMESTAMP field. (It's stored in
> microseconds, while dmesg shows it in seconds.)
>
> journalctl -o json _TRANSPORT=kernel | jq -r
> '"[\(._SOURCE_MONOTONIC_TIMESTAMP | tonumber / 1000000)] \(.MESSAGE)"'
>

(I forgot to include the SYSLOG_IDENTIFIER field in the output, but you get
the idea.)

-- 
Mantas Mikulėnas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20201201/3109526f/attachment.htm>