dmesg output prefixes every line with a figure such as [ 12.884301 ], and you need to correlate a disk error with an incident that happened at a known wall-clock time. Which option prints dates and times instead?
LPIC-1 Exam 101-500, objective 101. System architecture medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct dmesg -T
Correct. -T (--ctime) converts each record's timestamp into a human-readable local date and time by adding it to the recorded boot time.
Not correct dmesg -H
Wrong for this purpose. -H (--human) turns on the pager, colour and relative-time output: a block of messages is headed by a local timestamp and the lines inside it carry only a delta such as [ +0.004321 ], so the individual disk-error line still does not state its own wall-clock time. -T stamps every line.
Not correct dmesg -w
Wrong. -w (--follow) keeps the command running and prints new messages as they arrive, in the same format as before.
Not correct dmesg -x
Wrong. -x (--decode) spells out the facility and level of each message, such as kern:err, which says nothing about when it happened.
Why
The kernel ring buffer stores a monotonic timestamp measured in seconds since the kernel started, not a calendar time, so any date shown by dmesg is computed after the fact from the boot time. That is why -T is accurate only to about a second and drifts on machines that suspend, since the monotonic clock does not advance while suspended. Where absolute accuracy matters on a systemd machine, `journalctl -k` reads the same messages with real timestamps recorded as they were received.
Where this comes from
- Cited
- manual page dmesg(1)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 101 and space the ones you get wrong.
More questions on this objective
- You have a module file for a network driver on disk but the driver is not loaded. Which command reports the module's description, license, its dependencies and the parameters it accepts, without loading it into the kernel? machine-checked
- A module was loaded together with several modules it depends on. Which command unloads that module and then also unloads the dependencies that are left with a use count of zero? machine-checked
- You are filing a hardware bug report and the maintainer asks for the raw PCI vendor and device ID numbers rather than the human-readable names lspci normally prints. Which lspci option produces the numeric IDs? machine-checked
- A USB device is not getting the device node you expect. You want to watch, live, the kernel uevents and the resulting udev events as you unplug and replug it. Which command does that? machine-checked
- On a traditional BIOS PC, the firmware has completed its power-on self test and selected the hard disk as the boot device. What happens next? machine-checked
- A systemd-based machine fails during a normal boot because a service hangs. At the boot loader menu you want to edit the kernel command line for this one boot so the system comes up in single-user rescue mode instead. Which parameter do you append? machine-checked