get the creation time from core dump get the creation time from core dump unix unix

get the creation time from core dump


The creation time of the core file does not appear in the core(4) format in Solaris.

However, there are a couple of things you can do by looking at the NOTES section of the core (libelf to the rescue?). See core(4) for details.

First find the NOTES segment name (probably note0 or (more likely) note1, no leading dot) with objdump -x core

Process start time

The NT_PSINFO entry contains a psinfo_t (see <sys/procfs.h>) which has a member pr_start. This is the start time of the process.

Zonename

Similarly, the zonename where the core was generated is in the NT_ZONENAME entry.

Since this is char * a quick and dirty way to do this, without parsing the segment, is just to dump'n'grep it:

objdump -s -j note1 core | grep ...

(elfdump -n... sounds useful but I couldn't get this to work).