8 Getting Started With corelens

Debug a running kernel or vmcore crash dump file by using the corelens command.

Install the drgn-tools package. For more information, see Installing drgn-tools.

The corelens command requires kernel debugging information to function. That can be provided by installing a kernel DebugInfo package. For more information, see (Optional) Installing DebugInfo Packages.

Note:

If no DebugInfo packages are installed, for example because the system being debugged is deployed in a production environment, the corelens command instead uses the more lightweight Common Type Format (CTF) debugging information if that's available.

CTF is available if the system is running Oracle Linux 8 with the Unbreakable Enterprise Kernel (UEK).

The corelens command can be used to troubleshoot system problems by analyzing the contents of system images and crash dumps.

1. To debug /proc/kcore for a live kernel, run the following command:

   sudo corelens /proc/kcore

2. For more information about how to use the corelens command, use the -h option:

   corelens -h

A brief summary of the system state is provided as output from the corelens command.