Re: [Crash-utility] user-space enhancements

----- "James Bradshaw" <jbradsha(a)enterasys.com&gt; wrote: The LKCD project consisting of both the LKCD kernel patch and its associated "lcrash" user-space command, was first posted by SGI in 1999, literally within days of a parallel effort done by Mission Critical Linux when we posted our "mcore" kernel patch and our original "crash" utility. After the demise of Mission Critical Linux in 2002, I was hired by Red Hat, and brought the crash utility with me. While still at Mission Critical, however, I did add support for the LKCD dumpfile format in the crash utility, and the LKCD developers and I have passed stuff back-and-forth over the years. Anyway, neither mcore or the LKCD kernel patches were ever adopted upstream. After what seems to have been an eternity, finally the kdump facility was accepted. It seems highly unlikely that the kdump facility would ever be modified to also capture swap contents, although I suppose anything's possible. That all being said, given the core-dump masking support in the current kernels, you can now set /proc/<pid>/coredump_filter to pretty much strip almost everything out of the user core file, while still being able to debug the basics. Even when filtering out anonymous private and shared memory pages (which strips out user stack pages), the core dump is still usable by gdb, and will at least pinpoint the last known location. Dave