To examine the currently running kernel:

# crash

To determine the version of the kernel that produced a vmcore file:

# crash --osrelease /var/tmp/vmcore/2013-0211-2358.45-host03.28.core
2.6.39-200.24.1.el6uek.x86_64

To examine a vmcore file, specify the path to the file as an argument, for example:

# crash /var/tmp/vmcore/2013-0211-2358.45-host03.28.core

The appropriate vmlinux file must exist in /usr/lib/debug/lib/modules/kernel_version/.

If the vmlinux file is located elsewhere, specify its path before the path to the vmcore file, for example:

# crash /var/tmp/namelist/vmlinux-host03.28 /var/tmp/vmcore/2013-0211-2358.45-host03.28.core

The following crash output is from a vmcore file that was dumped after a system panic:

      KERNEL: /usr/lib/debug/lib/modules/2.6.39-200.24.1.el6uek.x86_64/vmlinux
    DUMPFILE: /var/tmp/vmcore/2013-0211-2358.45-host03.28.core
        CPUS: 2
        DATE: Fri Feb 11 16:55:41 2013
      UPTIME: 04:24;54
LOAD AVERAGE: 0.00, 0.01, 0.05
       TASKS: 84
    NODENAME: host03.mydom.com
     RELEASE: 2.6.39-200.24.1.el6uek.x86_64
     VERSION: #1 SMP Sat Jun 23 02:39:07 EDT 2012
     MACHINE: x86_64  (2992 MHz)
      MEMORY: 2 GB
       PANIC: "Oops: 0002" (check log for details)
         PID: 1696
     COMMAND: "insmod“
        TASK: c74de000
         CPU: 0
       STATE: TASK_RUNNING (PANIC)

crash>

The output includes the number of CPUs, the load average over the last 1 minute, last 5 minutes, and last 15 minutes, the number of tasks running, the amount of memory, the panic string, and the command that was executing at the time the dump was created. In this example, an attempt by insmod to install a module resulted in an oops violation.

At the crash> prompt, you can enter help or ? to display the available crash commands. Enter help command to display more information for a specified command.

crash commands can be grouped into several different groups according to purpose:

For more information, see the crash(8) manual page.