8 Getting Started With corelens

Debug a running kernel or vmcore crash dump file by using the corelens command.

Install the drgn-tools package. For more information, see Installing drgn-tools.

The corelens command requires kernel debugging information to function. That can be provided by installing a kernel DebugInfo package. For more information, see (Optional) Installing DebugInfo Packages.

Note:

If no DebugInfo packages are installed, for example because the system being debugged is deployed in a production environment, the corelens command instead uses the more lightweight Common Type Format (CTF) debugging information if that's available.

CTF is available if the system is running Oracle Linux 10 with the Unbreakable Enterprise Kernel (UEK).

The corelens command can be used to troubleshoot system problems by analyzing the contents of system images and crash dumps.

1. To debug /proc/kcore for a live kernel, run the following command:

   sudo corelens /proc/kcore

2. For more information about how to use the corelens command, use the -h option:

   corelens -h

A brief summary of the system state is provided as output from the corelens command.