Provided by: crash_3.8-2.1-3_i386
crash - A kernel debugging utility, supporting gdb like syntax.
crash [-h [opt]] [-v] [-s] [-i file] [-d num] [-S] [mapfile] [namelist]
This manual page documents briefly the crash command. This manual page
was written for the Debian GNU/Linux distribution because the original
program does not have a manual page. Instead, it has online
documentation; see below.
crash is a self-contained tool that can be used to investigate either
live systems, kernel core dumps created from the Kernel Core Dump patch
offered by Mission Critical Linux, or kernel core dumps created by the
LKCD patch offered by SGI.
The tool is loosely based on the SVR4 crash command, but has been
completely integrated with gdb in order to be able to display formatted
kernel data structures, disassemble source code, etc.
The current set of available commands consist of common kernel core
analysis tools such as a context-specific stack traces, source code
disassembly, kernel variable displays, memory display, dumps of linked-
lists, etc. In addition, any gdb command may be entered, which in turn
will be passed onto the gdb module for execution.
There are several commands that delve deeper into specific kernel
subsystems, which also serve as templates for kernel developers to
create new commands for analysis of a specific area of interest.
Adding a new command is a simple affair, and a quick recompile adds it
to the command menu.
The intent is to make the tool independent of Linux version
dependencies, building in recognition of major kernel code changes so
as to adapt to new kernel versions, while maintaining backwards
Most options are documented internal to crash. After running crash,
the help command will give you all the information you need.
The [namelist] argument is a pathname to an uncompressed kernel
image (a vmlinux file) that has been compiled with the "-g"
switch, or that has an accessible, associated, debuginfo file.
If the [dumpfile] argument is entered, then the [namelist]
argument must be entered If the [namelist] argument is not
entered when running on a live system, a search will be made in
several typical directories for for a kernel namelist file that
matches the live system.
The [dumpfile] argument is a pathname to a kernel memory core
dump file. If the [dumpfile] argument is not entered, the
session will be invoked on the live system using /dev/mem, which
usually requires root privileges.
If the live system kernel, or the kernel from which the
[dumpfile] was derived, was not compiled with the -g switch,
then the additional [mapfile] argument is required. The
[mapfile] argument may consist of either the associated
System.map file, or the non-debug kernel namelist. However, if
the [mapfile] argument is used, then the [namelist] argument
must be a kernel namelist of a similar kernel version that was
built with the -g switch.
-S Use "/boot/System.map" as the [mapfile].
Examples when running on a live system:
$ crash /usr/tmp/vmlinux
$ crash /boot/System.map vmlinux.dbg
$ crash -S vmlinux.dbg
$ crash vmlinux vmlinux.dbg
Examples when running on a dumpfile:
$ crash vmlinux vmcore
$ crash /boot/System.map vmlinux.dbg vmcore
$ crash -S vmlinux.dbg vmcore
$ crash vmlinux vmlinux.dbg vmcore
The -h option alone displays a help message. If the [opt]
argument is a crash command name, the help page for that command
is displayed. If the string "input" is entered, a page
describing the various crash command line input options is
displayed. If the string "output" is entered, a page describing
command line output options is displayed.
-v Display the versions of crash and gdb making up this executable.
-s Do not display any version, GPL, or crash initialization data;
proceed directly to the "crash>" prompt.
Execute the crash command(s) in [file] prior to accepting any
user input from the "crash>" prompt.
-d num Set crash debug level [num]. The higher the number, the more
debug data will be printed during crash runtime.
This manual page was written by Josh Huber <firstname.lastname@example.org>, for the
Debian GNU/Linux system (but may be used by others).
June 23, 2004 CRASH(8)