Re: [Crash-utility] How to work with crash utility.

----- Original Message ----- You're not exactly clear what has "failed" ... Ok, but I don't know whether you've already got a dumpfile, and you're asking how to do get one, or if you've got one but have questions about how to use the crash utility with it, or what? Nonetheless... If you've never used any crash utility before, then I'd suggest looking at the white paper here: http://people.redhat.com/anderson/crash_whitepaper But in a nutshell, first you will need to get the kernel-debuginfo and kernel-debuginfo-common packages for the F11 installation that you are running. If for example, you are running say, version 2.6.30.9-96.fc11 on an x86_64 machine, then the packages can be found here: http://koji.fedoraproject.org/koji/buildinfo?buildID=139687 And from that page you would download: kernel-debuginfo-2.6.30.9-96.fc11.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.30.9-96.fc11.x86_64.rpm It's highly unlikely you're actually running 2.6.30.9-96.fc11, so go here to find your specific kernel version's files: http://koji.fedoraproject.org/koji/packageinfo?packageID=8 To get a kernel as old as F11, you'll have to use the drop-down box on the right side of the page, and try to find yours. When you find them, install both packages with with "rpm -ivh". After doing that, the vmlinux file that you need to work with the crash utility would be located here: /usr/lib/debug/lib/modules/<kernel-version>/vmlinux You could also find it quickly by just entering "crash": $ crash and the invocation header will show the fully qualified pathname next to "KERNEL:". And so you would invoke the crash utility on your dumpfile like this: $ crash <path-to>/vmlinux <path-to>/vmcore Now, if you don't have kdump set up, then that's a whole other issue... There should be a cheat sheet somewhere to tell how to do it, but it's basically this: $ chkconfig kdump on Modify the running kernel's command line in /boot/grub/grub.conf to carve out memory space for the kdump kernel by adding "crashkernel=#M@#M" to the end of the line, like this: kernel /vmlinuz-2.6.30.9-96.fcll.x86_64 ...[cut ]... crashkernel=128M@32M Then reboot. When the system comes up again, enter: $ service kdump status and hopefully it's up and running. The crash the system -- kdump should save the dumpfile in a subdirectory of the /var/crash directory, with the name "vmcore". Then run crash as shown above: $ crash /usr/lib/debug/lib/modules/2.6.30.9-96.fc11.x86_64/vmlinux <path-to>/vmcore To be able to fully debug module-related crashes, you should run the "mod -S" command first to load the debuginfo data of all modules, and then enter "bt", which will give you a backtrace of the crashing task. That should hopefully get you started... Dave