dmesg tids logs problem.

Ved en dmesg kan du se logs fra kernel. Der kan du ikke se tids stemple.

$ dmesg

[4248617.618064] [UFW BLOCK] IN=eth0 OUT= MAC=f2:3c:91:16:52:96:84:78:ac:0d:8f:41:08:00 SRC=176.119.4.49 DST=139.162.207.23 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=22103 PROTO=TCP SPT=40689 DPT=22670 WINDOW=1024 RES=0x00 SYN URGP=0
[4248634.528232] [UFW BLOCK] IN=eth0 OUT= MAC=f2:3c:91:16:52:96:84:78:ac:5a:1a:41:08:00 SRC=198.108.67.54 DST=139.162.207.23 LEN=40 TOS=0x00 PREC=0x00 TTL=38 ID=36568 PROTO=TCP SPT=57194 DPT=1029 WINDOW=1024 RES=0x00 SYN URGP=0
[4248671.839504] [UFW BLOCK] IN=eth0 OUT= MAC=f2:3c:91:16:52:96:84:78:ac:5a:1a:41:08:00 SRC=185.153.198.208 DST=139.162.207.23 LEN=40 TOS=0x08 PREC=0x20 TTL=240

Men hvis du bruger dmest -T så skriver den det som normal dato tid.

$ dmest -T [Thu Dec 13 09:16:41 2018] [UFW BLOCK] IN=eth0 OUT= MAC=f2:3c:91:16:52:96:84:78:ac:0d:8f:41:08:00 SRC=194.55.142.100 DST=139.162.207.23 LEN=40 TOS=0x08 PREC=0x20 TTL=243 ID=34488 PROTO=TCP SPT=59536 DPT=7600 WINDOW=1024 RES=0x00 SYN URGP=0 [Thu Dec 13 09:17:08 2018] [UFW BLOCK] IN=eth0 OUT= MAC=f2:3c:91:16:52:96:84:78:ac:5a:1a:41:08:00 SRC=37.49.231.179 DST=139.162.207.23 LEN=443 TOS=0x08 PREC=0x20 TTL=55 ID=37784 DF PROTO=UDP SPT=5114 DPT=5060 LEN=423 [Thu Dec 13 09:17:21 2018] [UFW BLOCK] IN=eth0 OUT= MAC=f2:3c:91:16:52:96:84:78:ac:0d:8f:41:08:00 SRC=185.153.198.206 DST=139.162.207.23 LEN=40 TOS=0x08 PREC=0x20 TTL=240 ID=54321 PROTO=TCP SPT=42417 DPT=8555 WINDOW=65535 RES=0x00 SYN URGP=0

Det er ikke på alle Linux systemer du kan bruge -T så her er et script som giver samme funktion.

#!/bin/bash

# Translate dmesg timestamps to human readable format

# desired date format
date_format="%a %b %d %T %Y"

# uptime in seconds
uptime=$(cut -d " " -f 1 /proc/uptime)

# run only if timestamps are enabled
if [ "Y" = "$(cat /sys/module/printk/parameters/time)" ]; then
  dmesg | sed "s/^\[[ ]*\?\([0-9.]*\)\] \(.*\)/\\1 \\2/" | while read timestamp message; do
    printf "[%s] %s\n" "$(date --date "now - $uptime seconds + $timestamp seconds" +"${date_format}")" "$message"
  done
else
  echo "Timestamps are disabled (/sys/module/printk/parameters/time)"
fi