How to use the crash tool to analyze a Linux kernel crash dump file

Firstly, this paper introduces the basic concept and installation method of crash, then introduces how to use crash tool to analyze kernel crash dump file, including the usage of various common debugging commands, and finally demonstrates the powerful function of crash by several real cases encountered in practical work. In this article, both the detailed tool use method, but also has the rich actual http://www.aliyun.com/zixun/aggregation/7734.html "" > case analysis, I believe you will certainly benefit after reading.

What is crash

As mentioned earlier, when the Linux system kernel crashes, you can collect memory before the kernel crashes by kdump, and generate a dump file Vmcore. The kernel developer can diagnose the cause of the kernel crash by analyzing the Vmcore file, thus making code improvements for the operating system. So crash is a widely used kernel crash dump file analysis tool, master the use of crash skills, for positioning problems have a very important role.

Prerequisites for using crash

Because crash is used to debug dump files for kernel crashes, using crash requires that you rely on the following conditions:

1. The kernel image file Vmlinux must specify the-G parameter at compile time with debug information.

2. A memory crash dump file (such as Vmcore) is required or real-time system memory that can be accessed via mem or/dev/crash. If the crash command line does not specify a dump file, crash uses real-time system memory by default, which requires root permissions.

3. Crash supported platform processors include: x86, compatible, IA64, PPC64, ARM, s390, s390x (there are also some crash versions that support Alpha and 32-bit PowerPC, but support for both platforms does not guarantee long-term maintenance).

4. Crash supports 2.2.5-15 (including) later Linux kernel versions. As the Linux kernel is updated, crash is also being upgraded to accommodate the new kernel.

Crash Installation Guide

To debug a kernel dump file using crash, you need to install the crash tool and the kernel debug packet. There is a slight difference in the name of the different distribution installation package, and only the RHEL and SLES distributions are listed here as follows:

Table 1. Crash tools and kernel debug packs

Take RHEL as an example, the steps for installing crash and kernel debug packets are as follows:

Start crash

Startup parameter Description

To debug a dump file with crash, you need to enter two parameters at the command line: Debug kernel and dump file, where dump file is the name of the kernel dump file, and the debug kernel is installed by the kernel debug packet, with a slightly different distribution name to RHEL and SLES as examples:

Using Crash-h or man crash, you can view a range of options supported by crash, which are illustrated in the following examples:

-H: Print help information

-D: Set debug level

-S: Use/BOOT/SYSTEM.MAP as the default mapping file

-S: Do not display version, initial debugging information, etc., go directly to the command line

-I file: Automatically run the command in file after startup, and then accept user input