get the creation time from core dump
The creation time of the core file does not appear in the core(4)
format in Solaris.
However, there are a couple of things you can do by looking at the NOTES
section of the core (libelf to the rescue?). See core(4)
for details.
First find the NOTES
segment name (probably note0
or (more likely) note1
, no leading dot) with objdump -x core
Process start time
The NT_PSINFO
entry contains a psinfo_t
(see <sys/procfs.h>
) which has a member pr_start
. This is the start time of the process.
Zonename
Similarly, the zonename where the core was generated is in the NT_ZONENAME
entry.
Since this is char *
a quick and dirty way to do this, without parsing the segment, is just to dump'n'grep it:
objdump -s -j note1 core | grep ...
(elfdump -n...
sounds useful but I couldn't get this to work).