On Tue, Dec 1, 2020 at 1:46 PM Paul Menzel <pmenzel+systemd-devel@xxxxxxxxxxxxx> wrote:
At least to me, some of the entries with timestamps from resuming should
have timestamps from suspending. Is the reason, that “suspend message“
was only written to the journal after resume?
Probably because the journald process (like all other userspace processes) had already been frozen when those messages were written to dmesg, so it couldn't really receive them.
Is there a way to access the Linux kernel timestamp from within the journal?
Yes, as the _SOURCE_MONOTONIC_TIMESTAMP field. (It's stored in microseconds, while dmesg shows it in seconds.)
journalctl -o json _TRANSPORT=kernel | jq -r '"[\(._SOURCE_MONOTONIC_TIMESTAMP | tonumber / 1000000)] \(.MESSAGE)"'
Note that the kernel uses the monotonic clock for dmesg messages, which does not advance at all while the system is suspended -- so trying to convert it to realtime will often give wrong results (the same problem as in 'dmesg -e') unless you do something smart with combining it with journald's __REALTIME_TIMESTAMP.
Mantas Mikulėnas
_______________________________________________ systemd-devel mailing list systemd-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/systemd-devel
