How to convert timestamp in ips crash report on macOS 12.3

I'm looking at the JSON of an .ips crash report on macOS 12.3.

"uptime" : 21000,
  "procLaunch" : "2022-03-28 12:12:34.0643 +0200",
  "procRole" : "Unspecified",
  "version" : 2,
  "userID" : 0,
  "deployVersion" : 210,
  "modelCode" : "MacBookPro18,1",
  "procStartAbsTime" : 514306295821,
  "coalitionID" : 2566,
  "osVersion" : {
    "train" : "macOS 12.3",
    "build" : "21E230",
    "releaseType" : "User"
  },
  "captureTime" : "2022-03-28 12:12:45.1086 +0200",
  "incident" : "3B40D69B-0019-46D7-AD93-B73D02A4B636",
  "bug_type" : "309",
  "pid" : 17162,
  "procExitAbsTime" : 514570783723,

I was expecting the field procStartAbsTime and procExitAbsTime to be UNIX timestamps, but that would result in dates in 1986. What format are they and how can they be converted?

Also I noticed that BigSur creates both the old .crash and the new .ips format crash reports, even for the exact same crash, not at the same time though. So one time it creates a .crash, the next time an .ips.

Up vote post of wriker Down vote post of wriker
185 views
Posted by
wriker
Reply

  • I've constructed a crash which happens after 10s runtime. procExitAbsTime = 2089330565123 and procStartAbsTime = 2089084171024. The difference is 246.394.099 and should somehow correlate to ~10s.

    —
    wriker
Add a Comment

Replies

Those look like nanoseconds from mach_absolute_time or clock_gettime_nsec_np(CLOCK_UPTIME_RAW):

Was that crash after a wake from sleep?

Posted by
mikeyh
Up vote reply of mikeyh Down vote reply of mikeyh

  • Thanks for your help. It was an application crash during normal operation, not after wake. I wasn't able to extract any meaningful date from the timestamp. I've tried it with

    mach_timebase_info_data_t tb;   if (mach_timebase_info(&tb) == KERN_SUCCESS)     cout << 514306295821 * tb.numer / ( NSEC_PER_MSEC * tb.denom);
    —
    wriker
Add a Comment