How to check who triggered crash when vmcore doesn't have userspace data
Issue
- System crashed with manual crash, but no clue who triggered it
- vmcore generated has limited data and it doesn't show userspace details
...
PANIC: "SysRq : Trigger a crashdump"
PID: 19125
COMMAND: "bash"
...
crash> ps -p 19125
PID: 0 TASK: ffffffff80319b60 CPU: 0 COMMAND: "swapper"
PID: 1 TASK: ffff8101700ad7a0 CPU: 1 COMMAND: "init"
PID: 18174 TASK: ffff815ff9a37040 CPU: 40 COMMAND: "sshd"
PID: 18915 TASK: ffff811fdd237820 CPU: 0 COMMAND: "sshd"
PID: 19086 TASK: ffff811fdedd4080 CPU: 0 COMMAND: "sshd"
PID: 19087 TASK: ffff811ff7950100 CPU: 4 COMMAND: "bash"
PID: 19123 TASK: ffff811fce920820 CPU: 40 COMMAND: "sudo"
PID: 19124 TASK: ffff811fdc94f100 CPU: 0 COMMAND: "su"
PID: 19125 TASK: ffff811fe93c07e0 CPU: 2 COMMAND: "bash"
crash> ps -a 19087
PID: 19087 TASK: ffff811ff7950100 CPU: 4 COMMAND: "bash"
ps: cannot access user stack address: 7fffa4f72eb8
Environment
- Red Hat Enterprise Linux 5
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.