9.2.2 Running crash

Warning

Running crash on a live system is dangerous and can cause data corruption or total system failure. Do not use crash to examine a production system unless so directed by Oracle Support.

To examine the currently running kernel:

# crash

To determine the version of the kernel that produced a vmcore file:

# crash --osrelease /var/tmp/vmcore/2013-0211-2358.45-host03.28.core
2.6.39-200.24.1.el6uek.x86_64

To examine a vmcore file, specify the path to the file as an argument, for example:

# crash /var/tmp/vmcore/2013-0211-2358.45-host03.28.core

The appropriate vmlinux file must exist in /usr/lib/debug/lib/modules/kernel_version/.

If the vmlinux file is located elsewhere, specify its path before the path to the vmcore file, for example:

# crash /var/tmp/namelist/vmlinux-host03.28 /var/tmp/vmcore/2013-0211-2358.45-host03.28.core

The following crash output is from a vmcore file that was dumped after a system panic:

      KERNEL: /usr/lib/debug/lib/modules/2.6.39-200.24.1.el6uek.x86_64/vmlinux
    DUMPFILE: /var/tmp/vmcore/2013-0211-2358.45-host03.28.core
        CPUS: 2
        DATE: Fri Feb 11 16:55:41 2013
      UPTIME: 04:24;54
LOAD AVERAGE: 0.00, 0.01, 0.05
       TASKS: 84
    NODENAME: host03.mydom.com
     RELEASE: 2.6.39-200.24.1.el6uek.x86_64
     VERSION: #1 SMP Sat Jun 23 02:39:07 EDT 2012
     MACHINE: x86_64  (2992 MHz)
      MEMORY: 2 GB
       PANIC: "Oops: 0002" (check log for details)
         PID: 1696
     COMMAND: "insmod“
        TASK: c74de000
         CPU: 0
       STATE: TASK_RUNNING (PANIC)

crash>

The output includes the number of CPUs, the load average over the last 1 minute, last 5 minutes, and last 15 minutes, the number of tasks running, the amount of memory, the panic string, and the command that was executing at the time the dump was created. In this example, an attempt by insmod to install a module resulted in an oops violation.

At the crash> prompt, you can enter help or ? to display the available crash commands. Enter help command to display more information for a specified command.

crash commands can be grouped into several different groups according to purpose:

Kernel Data Structure Analysis Commands

Display kernel text and data structures. See Section 9.2.3, “Kernel Data Structure Analysis Commands”.

System state commands

Examine kernel subsystems on a system-wide or a per-task basis. See Section 9.2.4, “System State Commands”.

Helper commands

Perform calculation, translation, and search functions. See Section 9.2.5, “Helper Commands”

Session control commands

Control the crash session. See Section 9.2.6, “Session Control Commands”

For more information, see the crash(8) manual page.