kcrash(1M) — ADMINISTRATOR COMMANDS
NAME
kcrash − examine system images
SYNOPSIS
kcrash [ −w ] [ −s ] [ −c|−k ] dumpfile [ namelist ]
DESCRIPTION
The kcrash program, similar to the crash(1M) program, examines system crash dumps. Unlike crash, the kcrash command interface is based on the kernel debugger [see kdb(1M)]. All commands accepted by the kernel debugger can be used identically in kcrash, with the following exceptions:
• Execution commands (for example, go and tr) do not work.
• Multi-processor commands, with the exception of cpu (for example, gos, and ss) do not work.
• Instruction and memory breakpoint commands do not work.
• Instruction tracing commands do not work.
Commands that modify memory (actually modify the crash dump file) work only if the −w flag is present in the command line.
If the −k flag is present, dumpfile can be /dev/mem, allowing kcrash to be used on the running system. In addition, the following commands work only in kcrash (not in the kernel debugger):
If the −c flag is present, dumpfile will be interpreted as a crashdump file that was obtained by the crashdump function in the kernel. Otherwise it will be assumed that dumpfile was created by the rom debugger.
If the −s flag is present, kcrash will attempt to reconstruct the in-core symbol table from dumpfile. This obviates the need for the namelist file. In addition, kcrash will attempt to extract the KDB macros which were defined at crashtime. Note that the −s option may not always work; if the symbol table was corrupted at crashtime, or if certain kernel memory management pointers were corrupted, kcrash will be unable to reconstruct a useful symbol table. In such a case, use of the namelist file is required.
< filename
<< filename
Read and execute commands from the given file. Note that these commands are like dbcmd(1M) used with the kernel debugger.
! shell-command
!! shell-command
Executes the given shell command.
q
quit Quits kcrash.
date Without arguments, prints the date and time the system crashed. When given a timeval argument, date converts and outputs it as ascii text. This is useful for looking at fields such as access times in inodes.
syms syms dumps the entire symbol table in a simple format. This allows the symbol table to be converted for use by other tools.
FILES
/usr/lib/kdb/macros/∗
macros that are useful for kernel debugging
/unix default namelist
SEE ALSO
NOTES
The back trace command runs very slow when used to examine a running system.
— Multiprocessing