timeutil

Documentation

Index

• Constants
• func BootToEpochNS(ns uint64) uint64
• func ClockTicksToNsSinceBootTime(ticks uint64) uint64
• func EpochToBootTimeNS(ns uint64) uint64
• func GenerateRandomDuration(min, max int) time.Duration
• func GetBootTime() time.Time
• func GetBootTimeBoottimeNS() int64
• func GetBootTimeMonotonicNS() int64
• func GetBootTimeNS() int64
• func GetStartTimeNS() int64
• func GetSystemHZ() int
• func GetUsedClockID() int32
• func GetUserHZ() int64
• func Init(clockID int32) error
• func NsSinceBootTimeToTime(ns uint64) time.Time
• func NsSinceEpochToTime(ns uint64) time.Time
• func ProcfsStartTimeToEpochNS(startTimeJiffies uint64) uint64

Constants

const (
	CLOCK_MONOTONIC = unix.CLOCK_MONOTONIC // Time since a boot (not including time spent in suspend)
	CLOCK_BOOTTIME  = unix.CLOCK_BOOTTIME  // Time since a boot (including time spent in suspend)
)

Common clock IDs

Functions

func BootToEpochNS

func BootToEpochNS(ns uint64) uint64

BootToEpochNS converts time since boot to the epoch time

func ClockTicksToNsSinceBootTime

func ClockTicksToNsSinceBootTime(ticks uint64) uint64

ClockTicksToNsSinceBootTime converts kernel clock ticks to nanoseconds.

func EpochToBootTimeNS

func EpochToBootTimeNS(ns uint64) uint64

EpochToBootTimeNS converts time since epoch to relative time from boot

func GenerateRandomDuration

func GenerateRandomDuration(min, max int) time.Duration

GenerateRandomDuration returns a random duration between min and max, inclusive

func GetBootTime

func GetBootTime() time.Time

func GetBootTimeBoottimeNS

func GetBootTimeBoottimeNS() int64

GetBootTimeBoottimeNS returns the boot time calculated using CLOCK_BOOTTIME. This is used for procfs conversions, which are always BOOTTIME-based.

func GetBootTimeMonotonicNS

func GetBootTimeMonotonicNS() int64

GetBootTimeMonotonicNS returns the boot time calculated using CLOCK_MONOTONIC. Exposed for testing and potential future use.

func GetBootTimeNS

func GetBootTimeNS() int64

GetBootTimeNS returns the boot time of the system in nanoseconds since epoch. This uses the BPF clock base (whatever was passed to Init).

func GetStartTimeNS

func GetStartTimeNS() int64

relative to it.

func GetSystemHZ

func GetSystemHZ() int

GetSystemHZ returns an approximation of CONFIG_HZ (the kernel timer interrupt).

func GetUsedClockID

func GetUsedClockID() int32

GetUsedClockID returns the clock ID that was set during Init(). Returns CLOCK_BOOTTIME or CLOCK_MONOTONIC.

func GetUserHZ

func GetUserHZ() int64

GetUserHZ returns USER_HZ (the user-space timer interrupt), the system clock tick rate.

func Init

func Init(clockID int32) error

Init sets the reference points for (approximate) system and process start time. Run this function ASAP. Not running this function first will cause wrong behaviour in other functions of the package.

Reference points can be set from two different clocks: CLOCK_MONOTONIC or CLOCK_BOOTTIME. Tracee bpf code tries to use boottime clock if available, otherwise uses monotonic clock. ClockGettime get time elapsed since start (boot) so tracee can calculate event timestamps.

func NsSinceBootTimeToTime

func NsSinceBootTimeToTime(ns uint64) time.Time

NsSinceBootTimeToTime converts nanoseconds timestamp (since boot) to a time.Time object.

func NsSinceEpochToTime

func NsSinceEpochToTime(ns uint64) time.Time

func ProcfsStartTimeToEpochNS

func ProcfsStartTimeToEpochNS(startTimeJiffies uint64) uint64

ProcfsStartTimeToEpochNS converts a /proc/PID/stat starttime (jiffies, BOOTTIME) to epoch nanoseconds using the same clock base as BPF.

The /proc/PID/stat field 22 is ALWAYS in BOOTTIME clock (jiffies since boot, including suspend time). However, BPF might use MONOTONIC clock (excluding suspend time) on kernels where BPF_FUNC_ktime_get_boot_ns is unavailable.

This function ensures the procfs starttime matches the BPF clock base for consistent hash calculation.