[systemd-devel] Antw: [EXT] Journal message timestamps

[Lennart Poettering]

On Fr, 28.08.20 14:34, Mark Corbin (mark at dibsco.co.uk) wrote:

> For example, when /run/log/journal/d197a2e910964a7f9a0de6462d0d7c62/
> contains just 'system.journal' which has all log messages from:
>
> 'kernel: Booting Linux on physical CPU 0x0'
> up to and including:
> 'fake-hwclock[827]: Fri Aug 28 12:12:08 UTC 2020'
>
> then all messages displayed by journalctl are time stamped starting from
> 'Fri Aug 28 12:12:08' onwards. This is good - no problem.

So, as mentioned, we do not rewrite entries once written to disk and
they carry the original timestamp when they were gnerated, and if
that's off it's off. We will not "correct" something that was the
truth early on if we later figure out it wasn't actually true.

I think what you migh be seeing is the fact that we early on flush
kernel msgs into the journal, and since kernel msgs carry no elaborate
timestamps we generate them when we flush that. So maybe that flushing
happens after the fake rtc thing?

Lennart

--
Lennart Poettering, Berlin