crash(8)
Name
crash − examine system images
Syntax
/etc/crash [ system ] [ namelist ]
Description
The crash utility is an interactive program that lets you examine the core image of the operating system. This utility has facilities for interpreting and formatting the various control structures in the system and certain miscellaneous functions that are useful when perusing a dump.
The arguments to the crash utility are the file name where the system image can be found and a namelist file to be used for symbol values.
The default values are /dev/mem and /vmunix; hence, the crash utility specified without arguments can be used to examine an active system. If a system image file is given, it is assumed to be a system core dump and the default process is set to be that of the process running at the time of the crash. This is determined by a value stored in a fixed location by the dump mechanism.
Commands
Use the following input to the crash utility:
command [ options ] [ structures ]
If used, options modify the format of the printout. If a specific structure element is not specified, all valid entries are used. For example, proc 12 15 3 prints only process table slots 12, 15, and 3, but proc prints the entire process table in standard format.
In general, those commands that perform I/O with addresses assume hexadecimal on 32-bit machines and octal on 16-bit machines.
The commands include the following:
user [ process table entry ] [ *proc address ] [ #pid ]
Aliases: uarea, u_area, u.
Print the user structure of the named process as determined by the information contained in the process table entry. If an entry number is not given, the information from the last executing process is printed. Swapped processes produce an error message since their uareas are swapped.
ufile [ process table entry ] [ *proc address ] [ #pid ]
Print the open file table for the given process.
trace [ − ] [ process table entry ] [ *proc address ] [ #pid ]
Aliases: t.
Generate a kernel stack trace of a process. The process is either a process slot number, an address of process slot, or the running process. If the process is not running, the trace begins at the pcb. If an entry number is not given, the information from the last executing process will be printed. It is not possible to trace the executing process on a running system. Using the − flag allows the registers and variables for each stack frame to be dumped.
stack [ process table entry ] [ *proc address ] [ #pid ]
Aliases : s, stk.
Generate a kernel stack dump of a process. This is an unformatted display of the kernel stack.
proc [ −r] [ process table entry ] [ *proc address ] [ #pid ]
Aliases: p.
Format the process table. The −r option causes only runnable processes to be printed.
proclock [ −r] [ process table entry ] [ *proc address ] [ #pid ]
Show the SMP sleep locks held by a non-running process. Same optional arguments as proc.
pcb [ process table entry] [ *proc address] [ #pid ]
Print the process control block of the current process. The process control block is a part of the user area (VAXen only). If no entry number is given, the information from the last executing process will be printed.
ps [ process table entry ] [ *proc address ] [ #pid ]
Prints the process slots, process id’s, and process names for all processes.
pcb [ process table entry ] [ *proc address ] [ #pid ]
Prints the process control block for the given process.
ppte [ process table entry ] [ *proc address ] [ #pid ]
Prints the pte’s associated with the given process.
spt Dump the system page table.
cmap <page frame number>
Print the memory freelist or the cmap for the given PFN.
cmap −i index
Print the core map for the given coremap index.
cmap −h index
Print the core maps for the given hash starting at index.
cmap -b block
Print the core maps hashed on the given block.
cmap −a at
Print the core map at the given address.
gnode [ − ] [ gnode table entries ] [ *gnode address ]
Aliases: gno, g.
Format the gnode table.
gnode −maj <major number>
Format all gnodes with the given major number.
gnode −min <minor number>
Format all gnodes with the given minor number.
gnode −fs <mount slot number>
Format all gnodes for a given file system slot.
gnode −gno <gnode number>
Format all gnodes with the given gnode number.
gnode −uid <user id>
Format all gnodes owned by the given uid.
gnode −gid <group id>
Format all gnodes owned by the given gid.
gnode −lmod <file permissions>
Format all gnodes with the given protection. gnode -lmod 777 will find all gnodes that allow read/write/execute permission to every one.
gnode −hmod <file type>
Format all gnodes with the given file type. gnode -hmod 2 will find all gnodes that are character special files.
gnode −amod <file modes>
Format all gnodes that match the given modes exactly. gnode -amod 20777 will find all gnodes for character devices that allow read/write/execute permission to every one.
gnode −all
Display a more extensive list of the gnodes contents.
gnode −lock
Show the SMP lock contained in the gnode.
gfree Print the list of all inactive gnodes.
block [ − ] [ gnode table entries ] [ *gnode address ]
Print the gnode data block addresses.
rnode [ gnode table entries ] [ *gnode address ]
Alias: v.
Prints the associated rnode values for gnodes that are remote (via NFS).
file [ file table entries ] [ *file address ]
Alias: f.
Format the file table.
cred address
Print the credentials at the given address.
crred address
Verify the references of a credential at the given address.
crcheck
Verify all references to all credentials.
mount [ −s ] [ mount table entries ] [ *mount address ]
Aliases: mnt, m.
Format the mount table. The -s option gives a abbreviated format.
fsdata [ mount table entries ] [ *mount address ]
Alias: df.
Print the fsdata structure associated with a mount entry.
mntinfo [ mount table entries ] [ *mount address ]
Alias: mi.
Print the mntinfo data structure associate with an NFS file system.
buf [ − ] [ buffer headers ] [ *buffer header address ]
Aliases: hdr, bufhdr.
Format the system buffer headers. By using the −, all buffer headers (including ones marked invalid) are printed.
bufgp [ gnode slots ] [ *gnode address ]
Alias: cache.
Print the buffer headers associated with the given gnode.
buflock
Print the buffer headers on the locked list.
buflru
Print the buffer headers on the lru list.
bufage
Print the buffer headers on the aged list.
bufempty
Print the buffer headers on the empty list.
buffer [ format ] [ list of buffers ]
Alias: b.
Print the data in a system buffer according to format. If format is omitted, the previous format is used. Valid formats include decimal, octal, hex, character, byte, directory, gnode, and write. The last creates a file in the current directory (see the Files section) containing the buffer data.
text [ text table entries ] [ *text address ]
Aliases: txt, x.
Format the text table.
ftext Alias: freet.
Print out the list of free texts.
callout
Aliases: calls, call, c, timeout, time, tout.
Print all entries in the callout table.
arp [ − ] [ address ]
Print the arp table. The − option prints the entire table.
socket [ file slot ] [ *file address ]
Print out the socket structure associated with the given file slot.
tty [ − ] [ process slot ] [ *proc address ] [ #pid ]
Alias: term.
Print the terminal structure attached to a process. The − option allows for the raw, cannonical, and output clists.
tty -clist
Include clists in display of tty struct.
tty -addr address
Print out the contents of a tty structure at the specified address.
map [ map names ]
Format the named system map structures.
nm [ symbols ]
Print symbol value and type as found in the namelist file.
ts [ text addresses ]
Find the closest text symbols to the given addresses.
ds [ data addresses ]
Find the closest data symbols to the given addresses.
od [ symbol name or address ] [ count ] [ format ]
Aliases: dump, rd.
Dump count data values starting at the symbol value or address given according to format. Allowable formats are octal, longoct, decimal, longdec, character, hex, or byte.
dis address [ address ]
Disassemble starting at the first address and continuing until the second address. These addresses may be symbolic (that is, syscall+33).
stat Print useful statistics pertaining to the buffer cache, dnlc, namei translation cache, and others.
dupreq
Display the contents of the duplicate request cache. This is useful in finding out the recent history of NFS requests made to the server.
mbuf address
Display the mbuf chain starting at the given address.
inpcb -udp -tcp
Display the inpcb chain of the corresponding protocol, or both TCP and UDP if no protocol is specified.
client
Display the client table - contains client handles used to initiate rpc requests. sync Resync the proc, mount, gnode, buffer, file and other internal tables up to the current state of /dev/kmem. Useful for looking at changing values in runing kernels, but don’t bother using this while looking at vmcore files.
svcxprt address
Print out the svcxprt structure located at address.
scs Traverses data structures in the System Communications Services (SCS) tree and displays the contents of the data structures.
scs -cb address
Displays the contents of an SCS connection block data structure at the specified address.
scs -cib address
Displays the contents of an SCS connection information block data structure at the specified address.
scs -pb address
Displays the contents of an SCS path block data structure at the specified address.
scs -pib address
Displays the contents of an SCS path information block data structure at the specified address.
scs -sb address
Displays the contents of an SCS system block data structure at the specified address.
scs -sib address
Displays the contents of an SCS system information block data structure at the specified address.
scsi Print out SCSI controller information
scsi -target
Print out SCSI target information
scsi -devtab
Print out SCSI devtab information
scsi -trans
Print out SCSI transfer information
scsi -cmd
Print out SCSI message/command data
scsi -bbr
Print out SCSI Bad Block Replacement data
scsi -error
Print out SCSI error information
scsi -sii
Print out SCSI SII information
scsi -dct
Print out SCSI DCT stats
scsi -spin
Print out SCSI SPIN stats
scsi -all
Print out all SCSIBUS information
lock [-all] address
Print out the SMP lock structure located at address. all flag displays all global SMP locks.
mscp Traverse both the mscp disk and tape subsystems and print out the data structures for class blocks, connection blocks, unit blocks and active request blocks.
mscp -disk
Traverse the mscp disk subsystem and print out the data structures for the mscp class block, mscp connection blocks, mscp unit blocks and active request blocks.
mscp -tape
Traverse the tmscp tape subsystem and print out the data structures for the tmscp class block, tmscp connection blocks, tmscp unit blocks and active request blocks.
mscp -config
Traverse both the mscp disk and tape subsystems and display the system configuration. This is done by printing summary information from the class, connection and unit blocks.
mscp -connb address
Print out the contents of an mscp connection block at the specified address.
mscp -classb address
Print out the contents of an mscp class block at the specified address.
mscp -unitb address
Print out the contents of an mscp unitb block at the specified address.
mscp -reqb address
Print out the contents of an mscp request block at the specified address.
mscp -dtable
Display all the elements of the mscp disk unit table. Unused elements of the array will be specified as NULL.
mscp -ttable
Display all the elements of the tmscp tape unit table. Unused elements of the array will be specified as NULL.
! Escape to shell.
#[ history ]
Repeat the last command. If a number is given (that is, #5), that command number is re-executed.
#h Alias: history,
Show history list.
q Exit from crash.
? Print synopsis of commands.
Aliases
There are built-in aliases for many of the formats as well as those listed for the commands. Some of them are:
byte b.
character char, c.
decimal dec, e.
directory direct, dir, d.
hexadecimal hexadec, hex, h, x.
gnode gno , g.
longdec ld, D.
longoct lo, O.
octal oct, o.
write w.
Restrictions
Many of the flags are abbreviated making them difficult to interpret. A source listing of the system header files would be helpful when using the crash utility.
Examing the stack of the current process on a running system and procs running at the time of a crash does not work.
Files
/usr/include/sys/∗.h
header files for table and structure info
/dev/mem default system image file
/vmunix default namelist file
buf.# files created containing buffer data