46.3. Analyzing the Core Dump
Note
To analyze the
vmcore dump file, you must have the crash and kernel-debuginfo packages installed. To do so, type the following at a shell prompt as root:
~]# yum install --enablerepo=rhel-debuginfo crash kernel-debuginfo
Refer to Part II, “Package Management” for more information on how to install new packages in Red Hat Enterprise Linux.
To determine the cause of the system crash, you can use the
crash utility. This utility allows you to interactively analyze a running Linux system as well as a core dump created by netdump, diskdump, xendump, or kdump. When started, it presents you with an interactive prompt very similar to the GNU Debugger (GDB).
To start the utility, type the command in the following form at a shell prompt:
crash /var/crash/timestamp/vmcore /usr/lib/debug/lib/modules/kernel/vmlinux
Note that the kernel version should be the same as the one that was captured by
kdump. To find out which kernel you are currently running, use the uname -r command.
Example 46.2. Running the crash utility
~]#crash /var/crash/2010-08-04-17\:55/vmcore \/usr/lib/debug/lib/modules/2.6.18-194.8.1.el5/vmlinuxcrash 4.1.2-4.el5_5.1 Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 Red Hat, Inc. Copyright (C) 2004, 2005, 2006 IBM Corporation Copyright (C) 1999-2006 Hewlett-Packard Co Copyright (C) 2005, 2006 Fujitsu Limited Copyright (C) 2006, 2007 VA Linux Systems Japan K.K. Copyright (C) 2005 NEC Corporation Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc. Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc. This program is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Enter "help copying" to see the conditions. This program has absolutely no warranty. Enter "help warranty" for details. GNU gdb 6.1 Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i686-pc-linux-gnu"... KERNEL: /usr/lib/debug/lib/modules/2.6.18-194.8.1.el5/vmlinux DUMPFILE: /var/crash/2010-08-04-17:55/vmcore CPUS: 1 DATE: Wed Aug 4 17:50:41 2010 UPTIME: 00:56:53 LOAD AVERAGE: 0.47, 0.47, 0.55 TASKS: 128 NODENAME: localhost.localdomain RELEASE: 2.6.18-194.el5 VERSION: #1 SMP Tue Mar 16 21:52:43 EDT 2010 MACHINE: i686 (2702 Mhz) MEMORY: 1 GB PANIC: "SysRq : Trigger a crashdump" PID: 6042 COMMAND: "bash" TASK: f09c7000 [THREAD_INFO: e1ba9000] CPU: 0 STATE: TASK_RUNNING (SYSRQ) crash>
To exit the interactive prompt and terminate
crash, type exit.
46.3.1. Displaying the Message Buffer
To display the kernel message buffer, type the
log command at the interactive prompt.
Example 46.3. Displaying the kernel message buffer
crash> log
Linux version 2.6.18-194.el5 (mockbuild@x86-007.build.bos.redhat.com) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-48)) #1 SMP Tue Mar 16 21:52:43 EDT 2010
BIOS-provided physical RAM map:
BIOS-e820: 0000000000010000 - 000000000009fc00 (usable)
BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved)
BIOS-e820: 00000000000f0000 - 0000000000100000 (reserved)
BIOS-e820: 0000000000100000 - 000000003fff0000 (usable)
BIOS-e820: 000000003fff0000 - 0000000040000000 (ACPI data)
BIOS-e820: 00000000fffc0000 - 0000000100000000 (reserved)
127MB HIGHMEM available.
896MB LOWMEM available.
Using x86 segment limits to approximate NX protection
On node 0 totalpages: 262128
DMA zone: 4096 pages, LIFO batch:0
Normal zone: 225280 pages, LIFO batch:31
HighMem zone: 32752 pages, LIFO batch:7
DMI 2.5 present.
Using APIC driver default
... several lines omitted ...
SysRq : Trigger a crashdump
Type
help log for more information on the command usage.
