/var/crash Directory parsing

1: The generated crash is stored by default in:/var/crash, the file where the control is stored is:/var/sysconfig/kdump file. To see crash need to install the Kdump tool first, there will be kdump files that are not installed by default in openSUSE.

The 2:crash directory has four files, respectively:

LINUX:/VAR/CRASH/2015-01-04-14:37 # LL
Total 3084144
-rw-r--r--1 root root 187 Jan 4 14:40 README.txt
-rw-r--r--1 root root 1626134 Jan 4 14:40 System.map-2.6.32.59-0.7-default
-RW-------1 root root 3149631649 Jan 4 14:40 Vmcore
-rw-r--r--1 root root 3801265 Jan 4 14:40 vmlinux-2.6.32.59-0.7-default.gz
LINUX:/VAR/CRASH/2015-01-04-14:37 #

Vmcore is crash file; vmlinux-2.6.32.59-0.7-default.gz compressed bootable kernel (should be), GZ is decompressed by: Gunzip vmlinux-2.6.32.59-0.7-default.gz

3: Download the corresponding version of the code. The debug kernel with the corresponding version of the-G option is compiled, and the-G option can be opened by making menuconfig (when I compile it, I can debug the kernel without doing the process).

To view the kernel version of your system command: UNAME-R

In the finished package, Vmlinux is compiled with the debug kernel, you can copy the Vmlinx to the crash directory, and then enter crash Vmcore vmlinux in the directory. It means parsing the Vmcore file with the compiled kernel.

4: Then use the BT command to view the Register mod command to load the debug symbol struct to parse out an address structure

/var/crash Directory parsing