--
Crash-utility mailing list
Crash-utility@redhat.com
https://www.redhat.com/mailman/listinfo/crash-utility
Hi Sampathkumar,
First thing, presuming that the vmlinux file is associated with the 
  vmcore
file, take the System-map argument out of the picture -- 
  i.e, invoke the
session as:
 $ crash -d7 vmlinux vmcore
the -d7 will display a bunch of debug data.
What looks unusual is the ffffffff813a8200 address for "xtime".  
  That
would seem to be too high -- except perhaps if the vmlinux 
  you're working
against (or maybe the unnecessary System-map) is 
  the kdump kernel loaded
at 16MB?
If you do this, the output should show the exact same kernels:
 $ strings vmcore | grep "Linux version"
 $ strings vmlinux | grep "Linux version"
Dave
Hi Kishore,

On a RHEL4 x86_64 kernel, "xtime" is typically an address about
3-4 MB from the beginning load address of the kernel, (i.e. add
about 3-4 MB to the base virtual address of ffffffff80000000),
whereas your example shows it at about 19MB (13a8200).  Given 
that
the dumpfile read of ffffffff813a8200 failed, it looks as if 
the
physical memory region containing that address was not 
dumped,
which AFAICT with other kdump dumpfiles I have 
on-hand, the
"64MB@16MB" (or whatever size at 16MB) that is 
reserved for
the kdump kernel would *not* be captured in the 
/proc/vmcore
file.  So that kind of reinforces my suggestion 
that you are
perhaps using the wrong vmlinux (or System-map) 
associated with
the vmcore file.

Dave