crash - A kernel debugging utility, supporting gdb like syntax.

crash [-h [opt]] [-v] [-s] [-i file] [-d num] [-S] [mapfile] [namelist] [dumpfile]

This manual page documents briefly the crash command. This manual page was written for the Debian GNU/Linux distribution because the original program does not have a manual page. Instead, it has online documentation; see below.

crash is a self-contained tool that can be used to investigate either live systems, kernel core dumps created from the Kernel Core Dump patch offered by Mission Critical Linux, or kernel core dumps created by the LKCD patch offered by SGI.

The tool is loosely based on the SVR4 crash command, but has been completely integrated with gdb in order to be able to display formatted kernel data structures, disassemble source code, etc.

The current set of available commands consist of common kernel core analysis tools such as a context-specific stack traces, source code disassembly, kernel variable displays, memory display, dumps of linked-lists, etc. In addition, any gdb command may be entered, which in turn will be passed onto the gdb module for execution.

There are several commands that delve deeper into specific kernel subsystems, which also serve as templates for kernel developers to create new commands for analysis of a specific area of interest. Adding a new command is a simple affair, and a quick recompile adds it to the command menu.

The intent is to make the tool independent of Linux version dependencies, building in recognition of major kernel code changes so as to adapt to new kernel versions, while maintaining backwards compatibility.

Most options are documented internal to crash. After running crash, the help command will give you all the information you need.

namelist

The [namelist] argument is a pathname to an uncompressed kernel image (a vmlinux file) that has been compiled with the "-g" switch, or that has an accessible, associated, debuginfo file. If the [dumpfile] argument is entered, then the [namelist] argument must be entered If the [namelist] argument is not entered when running on a live system, a search will be made in several typical directories for for a kernel namelist file that matches the live system.

dumpfile

The [dumpfile] argument is a pathname to a kernel memory core dump file. If the [dumpfile] argument is not entered, the session will be invoked on the live system using /dev/mem, which usually requires root privileges.

mapfile

If the live system kernel, or the kernel from which the [dumpfile] was derived, was not compiled with the -g switch, then the additional [mapfile] argument is required. The [mapfile] argument may consist of either the associated System.map file, or the non-debug kernel namelist. However, if the [mapfile] argument is used, then the [namelist] argument must be a kernel namelist of a similar kernel version that was built with the -g switch.

-S

Use "/boot/System.map" as the [mapfile].

Examples when running on a live system:

$ crash $ crash /usr/tmp/vmlinux $ crash /boot/System.map vmlinux.dbg $ crash -S vmlinux.dbg $ crash vmlinux vmlinux.dbg

Examples when running on a dumpfile:

$ crash vmlinux vmcore $ crash /boot/System.map vmlinux.dbg vmcore $ crash -S vmlinux.dbg vmcore $ crash vmlinux vmlinux.dbg vmcore

-h [opt]

The -h option alone displays a help message. If the [opt] argument is a crash command name, the help page for that command is displayed. If the string "input" is entered, a page describing the various crash command line input options is displayed. If the string "output" is entered, a page describing command line output options is displayed.

-v

Display the versions of crash and gdb making up this executable.

-s

Do not display any version, GPL, or crash initialization data; proceed directly to the "crash>" prompt.

-i file

Execute the crash command(s) in [file] prior to accepting any user input from the "crash>" prompt.

-d num

Set crash debug level [num]. The higher the number, the more debug data will be printed during crash runtime.

gdb(1)

This manual page was written by Josh Huber <huber@mclx.com>, for the Debian GNU/Linux system (but may be used by others).