How can I get the system time from a core dump?

Question

I have a core dump generated after a segmentation fault. Is there a way in gdb ( or somehow else ) to see the system time when this happened?

I cannot use the creation time of the core dump file because it was sent to me without this meta info.

Solution

The system time is (unfortunately) not stored in a core file by default. You have a couple of options. One of them is to change the name of the core file to include the system time.

You can read more about this here.

Basically, you want to stick a "%t" into the name of the core file.

If you are running a custom kernel, you have more options.

For example, you could change the elf_prstatus structure to include other things you may want. This is an option that isn't without pain as off the shelf tools may not always be happy. You could add a custom note to the core file and include application specific information that you could then dump and inspect using readelf.

Comments

[amrith]

And if the core file was copied from one place to another? The questioner says "I cannot use the creation time of the core dump file because it was sent to me without this meta info".

[New to Rails]

Yes my bad.. The only way to is to ask the customer to do the ls -lrt on the directory and send the coredump along. This is what we used to do in my old project.