Analyzing WER dumps, I see time stamps like this:
Debug session time: Wed May 2 20:32:41.000 2007 (GMT+2)
Timezone is - as far as I remember - always GMT+2.
Now I found a dump with a USER32!ImeSystemHandler return address on stack and
also GMT+2 - quite unlikely, but not impossible.
Might it be, that timezone is displayed wrong?
My own TZ is GMT+2!
Hello Albrecht,
It looks like timezone used to display the session time is the
timezone of the debugger, not of the crashing machine. When I viewed
a few WER dumps from my seat here in TZ GMT-4, I see time stamps like:
Debug session time: Tue Dec 20 08:55:24.000 2005 (GMT-4)
It is an interesting question, whether the dump file does contain the
timezone setting of the crashing computer.
Best regards,
David
At 04:44 PM 5/15/2007 +0200, xxxxx@nero.com wrote:
Analyzing WER dumps, I see time stamps like this:
Debug session time: Wed May 2 20:32:41.000 2007 (GMT+2)
Timezone is - as far as I remember - always GMT+2.
Now I found a dump with a USER32!ImeSystemHandler return address on stack and
also GMT+2 - quite unlikely, but not impossible.Might it be, that timezone is displayed wrong?
My own TZ is GMT+2!
yeah session time is local session time
you can use .time extension to check that
lkd> .time
Debug session time: Tue May 15 21:53:05.557 2007 (GMT+5)
System Uptime: 0 days 3:02:01.168
lkd>
On 5/15/07, David Markun wrote:
> Hello Albrecht,
>
> It looks like timezone used to display the session time is the
> timezone of the debugger, not of the crashing machine. When I viewed
> a few WER dumps from my seat here in TZ GMT-4, I see time stamps like:
>
> Debug session time: Tue Dec 20 08:55:24.000 2005 (GMT-4)
>
> It is an interesting question, whether the dump file does contain the
> timezone setting of the crashing computer.
>
> Best regards,
> David
>
>
> At 04:44 PM 5/15/2007 +0200, xxxxx@nero.com wrote:
> >Analyzing WER dumps, I see time stamps like this:
> >
> > Debug session time: Wed May 2 20:32:41.000 2007 (GMT+2)
> >
> >Timezone is - as far as I remember - always GMT+2.
> >
> >Now I found a dump with a USER32!ImeSystemHandler return address on stack and
> >also GMT+2 - quite unlikely, but not impossible.
> >
> >Might it be, that timezone is displayed wrong?
> >My own TZ is GMT+2!
>
>
>
> —
> You are currently subscribed to windbg as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
and if the user mode minidump was created with /mt option you can
view that time using .ttime extension
On 5/15/07, raj_r wrote:
> yeah session time is local session time
>
> you can use .time extension to check that
>
> lkd> .time
> Debug session time: Tue May 15 21:53:05.557 2007 (GMT+5)
> System Uptime: 0 days 3:02:01.168
> lkd>
>
> On 5/15/07, David Markun wrote:
> > Hello Albrecht,
> >
> > It looks like timezone used to display the session time is the
> > timezone of the debugger, not of the crashing machine. When I viewed
> > a few WER dumps from my seat here in TZ GMT-4, I see time stamps like:
> >
> > Debug session time: Tue Dec 20 08:55:24.000 2005 (GMT-4)
> >
> > It is an interesting question, whether the dump file does contain the
> > timezone setting of the crashing computer.
> >
> > Best regards,
> > David
> >
> >
> > At 04:44 PM 5/15/2007 +0200, xxxxx@nero.com wrote:
> > >Analyzing WER dumps, I see time stamps like this:
> > >
> > > Debug session time: Wed May 2 20:32:41.000 2007 (GMT+2)
> > >
> > >Timezone is - as far as I remember - always GMT+2.
> > >
> > >Now I found a dump with a USER32!ImeSystemHandler return address on stack and
> > >also GMT+2 - quite unlikely, but not impossible.
> > >
> > >Might it be, that timezone is displayed wrong?
> > >My own TZ is GMT+2!
> >
> >
> >
> > —
> > You are currently subscribed to windbg as: xxxxx@gmail.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
Yes, debug session time is displayed in the local time zone (of the debugger
machine). For our custom-created dumps here, we record the real system time
zone information inside the dump so that we know the local timestamp when
the crash occured. I suppose that you won’t be able to take that approach
with WER, though.
–
Ken Johnson (Skywing)
Windows SDK MVP
http://www.nynaeve.net
wrote in message news:xxxxx@windbg…
> Analyzing WER dumps, I see time stamps like this:
>
> Debug session time: Wed May 2 20:32:41.000 2007 (GMT+2)
>
> Timezone is - as far as I remember - always GMT+2.
>
> Now I found a dump with a USER32!ImeSystemHandler return address on stack
> and
> also GMT+2 - quite unlikely, but not impossible.
>
> Might it be, that timezone is displayed wrong?
> My own TZ is GMT+2!
>
>