How to Examine a Crash Dump

1. Become superuser.

2. Examine a crash dumps by using the crash utility.

   # /usr/sbin/crash [-d crashdump-file] [-n name-list] [-w output-file]

   -d crashdump-file	Specifies a file to contain the system memory image. The default crash dump file is /dev/mem.
   -n name-list	Specifies a text file to contain symbol table information if you want to examine symbolic access to the system memory image. The default file name is /dev/ksyms.
   -w output-file	Specifies a file to contain output from a crash session. The default is standard output.

3. Display crash status information.

   # /usr/sbin/crash dumpfile = /dev/mem, namelist = /dev/ksyms, outfile = stdout > status . . . > size buf proc queue . . .

Example--Examining a Crash Dump

The following example shows sample output from the crash utility. Information about status, and about the buffer, process, and queue size is displayed.

# /usr/sbin/crash
dumpfile = /dev/mem, namelist = /dev/ksyms, outfile = stdout
> status
system name:    SunOS
release:        5.6
node name:      saturn
version:        Generic
machine name:   sun4m
time of crash:  Fri Jan 10 14:14:39 1997
age of system:  60 day, 5 hr., 24 min.
panicstr:
panic registers:
        eip: 0     esp: 0
> size buf proc queue
120
1552
88