How to convert timestamp in ips crash report on macOS 12.3

Question

wriker OP

Created Mar ’22

Replies 2

Boosts 1

Participants 2

I'm looking at the JSON of an .ips crash report on macOS 12.3.

"uptime" : 21000,
  "procLaunch" : "2022-03-28 12:12:34.0643 +0200",
  "procRole" : "Unspecified",
  "version" : 2,
  "userID" : 0,
  "deployVersion" : 210,
  "modelCode" : "MacBookPro18,1",
  "procStartAbsTime" : 514306295821,
  "coalitionID" : 2566,
  "osVersion" : {
    "train" : "macOS 12.3",
    "build" : "21E230",
    "releaseType" : "User"
  },
  "captureTime" : "2022-03-28 12:12:45.1086 +0200",
  "incident" : "3B40D69B-0019-46D7-AD93-B73D02A4B636",
  "bug_type" : "309",
  "pid" : 17162,
  "procExitAbsTime" : 514570783723,

I was expecting the field procStartAbsTime and procExitAbsTime to be UNIX timestamps, but that would result in dates in 1986. What format are they and how can they be converted?

Also I noticed that BigSur creates both the old .crash and the new .ips format crash reports, even for the exact same crash, not at the same time though. So one time it creates a .crash, the next time an .ips.

Boost

Answer 1

mikeyh OP

Mar ’22

Those look like nanoseconds from mach_absolute_time or clock_gettime_nsec_np(CLOCK_UPTIME_RAW):

https://developer.apple.com/documentation/kernel/1462446-mach_absolute_time

Was that crash after a wake from sleep?

0

Answer 2

wriker OP

Mar ’22

I've constructed a crash which happens after 10s runtime. procExitAbsTime = 2089330565123 and procStartAbsTime = 2089084171024. The difference is 246.394.099 and should somehow correlate to ~10s.

0