----- Original Message -----
Hi,
In reference to bug :
https://bugzilla.redhat.com/show_bug.cgi?id=233151
I have the same problem trying to analyze a vmss.core file with kernel
v4.4.0-36-generic (Ubuntu) :
q
crash: /usr/lib/debug/boot/ vmlinux-4.4.0-36-generic and
/var/vmss_m.core do
not match!
I also tried with the following (as recommended in the bug threads) without
success :
--machdep phys_base=0x200000
That was an old Xen RHEL5 kernel issue, so I don't know if that applies to
your 4.4-based VMware vmss dumpfile (?). Although I only have a 4 sample
vmss dumpfiles, one of does happen to be a RHEL5 kernel and it does require
--machdep phys_base=0x200000.
But it's certainly possible that could be the issue. If you run the guest again
and log into it, you could try running crash on the live system. If it comes up OK,
run the "help -m" command and grep for "phys_base". Then try that
value as the
--machdep phys_base= argument with the dumpfile.
Worse case, you could try different phys_base values and basically fish for
the correct value.
I'm using the right -dbgsym for the right kernel as confirmed here :
$ strings vmss_m.core | grep "Linux version"
Linux version 4.4.0-36-generic (buildd@lgw01-20) (gcc version 4.8.4 (Ubuntu
4.8.4-2ubuntu1~14.04.3) ) #55~14.04.1-Ubuntu SMP Fri Aug 12 11:49:30 UTC
2016 (Ubuntu 4.4.0-36.55~14.04.1-generic 4.4.16)
What does "strings vmlinux-4.4.0-36-generic" show? You'll need to verify
that
the full string above is exactly the same.
$ readelf -a vmss_m.core
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
NOTE 0x00000000000000e8 0x0000000000000000 0x0000000000000000
0x0000000000000218 0x0000000000000000 0
LOAD 0x0000000080001000 0x00000000fff80000 0x00000000fff80000
0x0000000000080000 0x0000000000080000 RWE 1000
LOAD 0x0000000000001000 0x0000000000000000 0x0000000000000000
0x0000000080000000 0x0000000080000000 RWE 1000
The VirtAddr and PhysAddr are just zero.
It's the PhysAddr that's the key to crash -- the header is showing that
the dumpfile contains 2GB (0x80000000) of physical memory starting at
physical address 0.
I tried with the latest and greatest crash-utility from [
https://github.com/crash-utility/crash.git ] using version 7.1.5++ but this
has no effect, I still have the error :
crash: /usr/lib/debug/boot/ vmlinux-4.4.0-36-generic and /var/vmss_m.core do not match!
Any ideas ?
- Eric
If you show the output of "crash -d8 ..." it may yield some more clues.
Dave