Red Hat Training
A Red Hat training course is available for Red Hat Enterprise Linux
46.3. Analyzing the Core Dump
To analyze the
vmcoredump file, you must have the crash and kernel-debuginfo packages installed. To do so, type the following at a shell prompt as
yum install --enablerepo=rhel-debuginfo crash kernel-debuginfo
Refer to Part II, “Package Management” for more information on how to install new packages in Red Hat Enterprise Linux.
To determine the cause of the system crash, you can use the
crashutility. This utility allows you to interactively analyze a running Linux system as well as a core dump created by
kdump. When started, it presents you with an interactive prompt very similar to the GNU Debugger (GDB).
To start the utility, type the command in the following form at a shell prompt:
crash /var/crash/timestamp/vmcore /usr/lib/debug/lib/modules/kernel/vmlinux
Note that the kernel version should be the same as the one that was captured by
kdump. To find out which kernel you are currently running, use the
Example 46.2. Running the
crash /var/crash/2010-08-04-17\:55/vmcore \
/usr/lib/debug/lib/modules/2.6.18-194.8.1.el5/vmlinuxcrash 4.1.2-4.el5_5.1 Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 Red Hat, Inc. Copyright (C) 2004, 2005, 2006 IBM Corporation Copyright (C) 1999-2006 Hewlett-Packard Co Copyright (C) 2005, 2006 Fujitsu Limited Copyright (C) 2006, 2007 VA Linux Systems Japan K.K. Copyright (C) 2005 NEC Corporation Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc. Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc. This program is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Enter "help copying" to see the conditions. This program has absolutely no warranty. Enter "help warranty" for details. GNU gdb 6.1 Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i686-pc-linux-gnu"... KERNEL: /usr/lib/debug/lib/modules/2.6.18-194.8.1.el5/vmlinux DUMPFILE: /var/crash/2010-08-04-17:55/vmcore CPUS: 1 DATE: Wed Aug 4 17:50:41 2010 UPTIME: 00:56:53 LOAD AVERAGE: 0.47, 0.47, 0.55 TASKS: 128 NODENAME: localhost.localdomain RELEASE: 2.6.18-194.el5 VERSION: #1 SMP Tue Mar 16 21:52:43 EDT 2010 MACHINE: i686 (2702 Mhz) MEMORY: 1 GB PANIC: "SysRq : Trigger a crashdump" PID: 6042 COMMAND: "bash" TASK: f09c7000 [THREAD_INFO: e1ba9000] CPU: 0 STATE: TASK_RUNNING (SYSRQ) crash>
To exit the interactive prompt and terminate
46.3.1. Displaying the Message Buffer
To display the kernel message buffer, type the
logcommand at the interactive prompt.
Example 46.3. Displaying the kernel message buffer
logLinux version 2.6.18-194.el5 (firstname.lastname@example.org) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-48)) #1 SMP Tue Mar 16 21:52:43 EDT 2010 BIOS-provided physical RAM map: BIOS-e820: 0000000000010000 - 000000000009fc00 (usable) BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved) BIOS-e820: 00000000000f0000 - 0000000000100000 (reserved) BIOS-e820: 0000000000100000 - 000000003fff0000 (usable) BIOS-e820: 000000003fff0000 - 0000000040000000 (ACPI data) BIOS-e820: 00000000fffc0000 - 0000000100000000 (reserved) 127MB HIGHMEM available. 896MB LOWMEM available. Using x86 segment limits to approximate NX protection On node 0 totalpages: 262128 DMA zone: 4096 pages, LIFO batch:0 Normal zone: 225280 pages, LIFO batch:31 HighMem zone: 32752 pages, LIFO batch:7 DMI 2.5 present. Using APIC driver default ... several lines omitted ... SysRq : Trigger a crashdump
help logfor more information on the command usage.