How to check who triggered crash when vmcore doesn't have userspace data

Solution Verified - Updated -

Issue

  • System crashed with manual crash, but no clue who triggered it
  • vmcore generated has limited data and it doesn't show userspace details
...
       PANIC: "SysRq : Trigger a crashdump"
         PID: 19125
     COMMAND: "bash"
...

crash> ps -p 19125
PID: 0      TASK: ffffffff80319b60  CPU: 0   COMMAND: "swapper"
 PID: 1      TASK: ffff8101700ad7a0  CPU: 1   COMMAND: "init"
  PID: 18174  TASK: ffff815ff9a37040  CPU: 40  COMMAND: "sshd"
   PID: 18915  TASK: ffff811fdd237820  CPU: 0   COMMAND: "sshd"
    PID: 19086  TASK: ffff811fdedd4080  CPU: 0   COMMAND: "sshd"
     PID: 19087  TASK: ffff811ff7950100  CPU: 4   COMMAND: "bash"
      PID: 19123  TASK: ffff811fce920820  CPU: 40  COMMAND: "sudo"
       PID: 19124  TASK: ffff811fdc94f100  CPU: 0   COMMAND: "su"
        PID: 19125  TASK: ffff811fe93c07e0  CPU: 2   COMMAND: "bash"

crash> ps -a 19087
PID: 19087  TASK: ffff811ff7950100  CPU: 4   COMMAND: "bash"
ps: cannot access user stack address: 7fffa4f72eb8

Environment

  • Red Hat Enterprise Linux 5

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.