time

Documentation

Index

• Constants
• func BootToEpochNS(ns uint64) uint64
• func EpochToBootTimeNS(ns uint64) uint64
• func GetBootTime() time.Time
• func GetBootTimeNS() int64
• func GetStartTimeNS() int64
• func GetSystemHZ() int
• func Init(clockID int32) error
• func NsSinceBootTimeToTime(ns uint64) time.Time
• func NsSinceEpochToTime(ns uint64) time.Time

Constants

const (
	CLOCK_MONOTONIC = unix.CLOCK_MONOTONIC // Time since a boot (not including time spent in suspend)
	CLOCK_BOOTTIME  = unix.CLOCK_BOOTTIME  // Time since a boot (including time spent in suspend)
)

Common clock IDs

Functions

func BootToEpochNS

func BootToEpochNS(ns uint64) uint64

BootToEpochNS converts time since boot to the epoch time

func EpochToBootTimeNS

func EpochToBootTimeNS(ns uint64) uint64

EpochToBootTimeNS converts time since epoch to relative time from boot

func GetBootTime

func GetBootTime() time.Time

func GetBootTimeNS

func GetBootTimeNS() int64

GetBootTimeNS returns the boot time of the system in nanoseconds since epoch.

func GetStartTimeNS

func GetStartTimeNS() int64

relative to it.

func GetSystemHZ

func GetSystemHZ() int

GetSystemHZ returns an approximation of CONFIG_HZ (the kernel timer interrupt).

func Init

func Init(clockID int32) error

Init sets the reference points for (approximate) system and process start time. Run this function ASAP. Not running this function first will cause wrong behaviour in other functions of the package.

Reference points can be set from two differents clocks: CLOCK_MONOTONIC or CLOCK_BOOTTIME. Tracee bpf code tries to use boottime clock if available, otherwise uses monotonic clock. ClockGettime get time elapsed since start (boot) so tracee can calculate event timestamps.

func NsSinceBootTimeToTime

func NsSinceBootTimeToTime(ns uint64) time.Time

NsSinceBootTimeToTime converts nanoseconds timestamp (since boot) to a time.Time object.

func NsSinceEpochToTime

func NsSinceEpochToTime(ns uint64) time.Time