Hi,
I m maintaining certain log files. One log file has its input filled by
KeQueryTickCount. The other log file has
absolute system time in hour, minute, seconds, milliseconds format. Is there
a way to combine merge these time stamps?
with thanks
kutty s banerjee
Tick count rolls over every 43 days or so, and starts from zero at about whatever arbitrary time the system is booted. Thus it may be considered an arbitrary number, if not quite a random number. The only way to convert it to something real is on the machine where it is being produced, and within a reasonably short interval of when it was originally produced.
You can trivially write a program to take a number, difference it from the current tick count, and determine an offset from ‘now’ to when the time would have occurred in this or the preceding tick count cycle. You can then determine what time that occurance would have actually been. The time you determine may or may not be the same as the original timestamp, depending on how long ago the original tick count timestamp was made, and how many reboots have occurred inbetween.
Loren
-----Original Message-----
From: Kutty Banerjee
Sent: Dec 23, 2004 2:21 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] time stamp conversions
Hi,
I m maintaining certain log files. One log file has its input filled by
KeQueryTickCount. The other log file has
absolute system time in hour, minute, seconds, milliseconds format. Is there
a way to combine merge these time stamps?