Update, If I try to open with command: "crash -d1 ..." I get: [root@centos511test kernel]# crash -d1 vmcore /usr/lib/debug/lib/modules/`uname -r`/vmlinux crash 5.1.8-3.el5.centos Copyright (C) 2002-2011 Red Hat, Inc. Copyright (C) 2004, 2005, 2006 IBM Corporation Copyright (C) 1999-2006 Hewlett-Packard Co Copyright (C) 2005, 2006 Fujitsu Limited Copyright (C) 2006, 2007 VA Linux Systems Japan K.K. Copyright (C) 2005 NEC Corporation Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc. Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc. This program is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Enter "help copying" to see the conditions. This program has absolutely no warranty. Enter "help warranty" for details. compressed kdump: header->utsname.machine: x86_64 diskdump_data: filename: vmcore flags: 6 (KDUMP_CMPRS_LOCAL|ERROR_EXCLUDED) dfd: 3 ofp: 0 machine_type: 62 (EM_X86_64) header: 11820fe0 signature: "KDUMP " header_version: 6 utsname: sysname: Linux nodename: lnbrsasp41 release: 3.10.0-693.17.1.el7.x86_64 version: #1 SMP Sun Jan 14 10:36:03 EST 2018 machine: x86_64 domainname: (none) timestamp: tv_sec: 5b25ead0 tv_usec: 0 status: 1 (DUMP_HEADER_INCOMPLETED) block_size: 4096 sub_hdr_size: 1 bitmap_blocks: 1040 max_mapnr: 17039360 total_ram_blocks: 0 device_blocks: 0 written_blocks: 0 current_cpu: 0 nr_cpus: 4 tasks[nr_cpus]: 0 0 0 0 sub_header: 0 (n/a) Does it mean they gave me bad vmcore ? Why the version in "release" is release: 3.10.0-693.17.1.el7.x86_64 ?

---------- Forwarded message --------- From: Ilan Schwarts <ilan84(a)gmail.com&gt; Date: Sun, Jun 24, 2018 at 4:00 PM Subject: Redhat 5.11 dump To: <crash-utility(a)redhat.com&gt; Hi, A production machine with Red Hat Enterprise Linux Server release 5.11 (Tikanga) kernel 2.6.18-431.el5 crashed. I received vmcore, Since I dont have access to machine, and I need to open the vmcore to analyze the dump, I have downloaded CentOS 5.11, since centos 5.11 is EOL, I downloaded the 2.6.18-431.el5 kernel manually, with debuginfo and debuginfo-common and installed them, so far - seems ok. I am trying to get call stack of the dump time, i get error: [root@centos511test kernel]# crash vmcore /usr/lib/debug/lib/modules/`uname -r`/vmlinux crash 5.1.8-3.el5.centos Copyright (C) 2002-2011 Red Hat, Inc. Copyright (C) 2004, 2005, 2006 IBM Corporation Copyright (C) 1999-2006 Hewlett-Packard Co Copyright (C) 2005, 2006 Fujitsu Limited Copyright (C) 2006, 2007 VA Linux Systems Japan K.K. Copyright (C) 2005 NEC Corporation Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc. Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc. This program is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Enter "help copying" to see the conditions. This program has absolutely no warranty. Enter "help warranty" for details. GNU gdb (GDB) 7.0 Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-unknown-linux-gnu"... crash: page excluded: kernel virtual address: ffffffff804d3ae0 type: "possible" WARNING: cannot read cpu_possible_map crash: page excluded: kernel virtual address: ffffffff804735e0 type: "present" WARNING: cannot read cpu_present_map crash: page excluded: kernel virtual address: ffffffff8046e260 type: "online" WARNING: cannot read cpu_online_map crash: page excluded: kernel virtual address: ffffffff80475210 type: "xtime" [root@centos511test kernel]# Any thoughts ? how can I continue ? Thanks alot -- - Ilan Schwarts -- Crash-utility mailing list Crash-utility(a)redhat.com https://www.redhat.com/mailman/listinfo/crash-utility

----- Original Message ----- > > Update, If I try to open with command: "crash -d1 ..." I get: > > [root@centos511test kernel]# crash -d1 vmcore > > /usr/lib/debug/lib/modules/`uname -r`/vmlinux > > > > crash 5.1.8-3.el5.centos > > Copyright (C) 2002-2011 Red Hat, Inc. > > Copyright (C) 2004, 2005, 2006 IBM Corporation > > Copyright (C) 1999-2006 Hewlett-Packard Co > > Copyright (C) 2005, 2006 Fujitsu Limited > > Copyright (C) 2006, 2007 VA Linux Systems Japan K.K. > > Copyright (C) 2005 NEC Corporation > > Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc. > > Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc. > > This program is free software, covered by the GNU General Public License, > > and you are welcome to change it and/or distribute copies of it under > > certain conditions. Enter "help copying" to see the conditions. > > This program has absolutely no warranty. Enter "help warranty" for > > details. > > > > compressed kdump: header->utsname.machine: x86_64 > > diskdump_data: > > filename: vmcore > > flags: 6 (KDUMP_CMPRS_LOCAL|ERROR_EXCLUDED) > > dfd: 3 > > ofp: 0 > > machine_type: 62 (EM_X86_64) > > > > header: 11820fe0 > > signature: "KDUMP " > > header_version: 6 > > utsname: > > sysname: Linux > > nodename: lnbrsasp41 > > release: 3.10.0-693.17.1.el7.x86_64 > > version: #1 SMP Sun Jan 14 10:36:03 EST 2018 > > machine: x86_64 > > domainname: (none) > > timestamp: > > tv_sec: 5b25ead0 > > tv_usec: 0 > > status: 1 (DUMP_HEADER_INCOMPLETED) > > block_size: 4096 > > sub_hdr_size: 1 > > bitmap_blocks: 1040 > > max_mapnr: 17039360 > > total_ram_blocks: 0 > > device_blocks: 0 > > written_blocks: 0 > > current_cpu: 0 > > nr_cpus: 4 > > tasks[nr_cpus]: 0 > > 0 > > 0 > > 0 > > > > sub_header: 0 (n/a) > > > > > > Does it mean they gave me bad vmcore ? Why the version in "release" is > > release: 3.10.0-693.17.1.el7.x86_64 ? > > > > Looks like it. Not only was the vmcore created from the crash of > a rhel7-vintage kernel (3.10.0-693.17.1.el7), the dumpfile also > shows that kdump operation failed to complete correctly, as > indicated by the DUMP_HEADER_INCOMPLETED flag. That flag would > have been removed if the dumpfile creation completed normally. Just to clarifiy, the DUMP_HEADER_INCOMPLETED flag displayed above is incorrect when the "status" field gets translated in crash-5.1.8-3. That ancient version of crash was not aware of the change in bit-meaning of the status field used by the makedumpfile facility. A value of "1" means that the vmcore was compressed using libz: #define DUMP_DH_COMPRESSED_ZLIB 0x1 /* page is compressed with zlib */ #define DUMP_DH_COMPRESSED_LZO 0x2 /* page is compressed with lzo */ #define DUMP_DH_COMPRESSED_SNAPPY 0x4 /* page is compressed with snappy */ #define DUMP_DH_COMPRESSED_INCOMPLETE 0x8 /* dumpfile is incomplete */ #define DUMP_DH_EXCLUDED_VMEMMAP 0x10 /* unused vmemmap pages are excluded */ In any case, you have a legitimate RHEL7 vmcore, and as such, it fails as expected when trying to use a RHEL5 vmlinux file with it. Dave > > Dave > > > > > > > > > > > > > > > > > > > > > > > > ---------- Forwarded message --------- > > From: Ilan Schwarts <ilan84(a)gmail.com&gt; > > Date: Sun, Jun 24, 2018 at 4:00 PM > > Subject: Redhat 5.11 dump > > To: <crash-utility(a)redhat.com&gt; > > > > > > Hi, > > A production machine with Red Hat Enterprise Linux Server release 5.11 > > (Tikanga) kernel 2.6.18-431.el5 crashed. > > I received vmcore, Since I dont have access to machine, and I need to > > open the vmcore to analyze the dump, I have downloaded CentOS 5.11, > > since centos 5.11 is EOL, I downloaded the 2.6.18-431.el5 kernel > > manually, with debuginfo and debuginfo-common and installed them, so > > far - seems ok. > > > > I am trying to get call stack of the dump time, i get error: > > [root@centos511test kernel]# crash vmcore > > /usr/lib/debug/lib/modules/`uname -r`/vmlinux > > > > crash 5.1.8-3.el5.centos > > Copyright (C) 2002-2011 Red Hat, Inc. > > Copyright (C) 2004, 2005, 2006 IBM Corporation > > Copyright (C) 1999-2006 Hewlett-Packard Co > > Copyright (C) 2005, 2006 Fujitsu Limited > > Copyright (C) 2006, 2007 VA Linux Systems Japan K.K. > > Copyright (C) 2005 NEC Corporation > > Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc. > > Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc. > > This program is free software, covered by the GNU General Public License, > > and you are welcome to change it and/or distribute copies of it under > > certain conditions. Enter "help copying" to see the conditions. > > This program has absolutely no warranty. Enter "help warranty" for > > details. > > > > GNU gdb (GDB) 7.0 > > Copyright (C) 2009 Free Software Foundation, Inc. > > License GPLv3+: GNU GPL version 3 or later > > <http://gnu.org/licenses/gpl.html> > > This is free software: you are free to change and redistribute it. > > There is NO WARRANTY, to the extent permitted by law. Type "show copying" > > and "show warranty" for details. > > This GDB was configured as "x86_64-unknown-linux-gnu"... > > > > crash: page excluded: kernel virtual address: ffffffff804d3ae0 type: > > "possible" > > WARNING: cannot read cpu_possible_map > > crash: page excluded: kernel virtual address: ffffffff804735e0 type: > > "present" > > WARNING: cannot read cpu_present_map > > crash: page excluded: kernel virtual address: ffffffff8046e260 type: > > "online" > > WARNING: cannot read cpu_online_map > > crash: page excluded: kernel virtual address: ffffffff80475210 type: > > "xtime" > > [root@centos511test kernel]# > > > > Any thoughts ? how can I continue ? > > > > Thanks alot > > > > > > -- > > > > > > - > > Ilan Schwarts > > > > -- > > Crash-utility mailing list > > Crash-utility(a)redhat.com > > https://www.redhat.com/mailman/listinfo/crash-utility > > > > > > -- > Crash-utility mailing list > Crash-utility(a)redhat.com > https://www.redhat.com/mailman/listinfo/crash-utility > -- Crash-utility mailing list Crash-utility(a)redhat.com https://www.redhat.com/mailman/listinfo/crash-utility