How can I get the system time from a core dump?

Question

I have a core dump generated after a segmentation fault. Is there a way in gdb ( or somehow else ) to see the system time when this happened?

I cannot use the creation time of the core dump file because it was sent to me without this meta info.

Answer 1

The system time is (unfortunately) not stored in a core file by default. You have a couple of options. One of them is to change the name of the core file to include the system time.

You can read more about this here.

Basically, you want to stick a "%t" into the name of the core file.

If you are running a custom kernel, you have more options.

For example, you could change the elf_prstatus structure to include other things you may want. This is an option that isn't without pain as off the shelf tools may not always be happy. You could add a custom note to the core file and include application specific information that you could then dump and inspect using readelf.