LCRASH(1)

NAME
lcrash - linux crash dump analyzer

SYNOPSIS
lcrash [ -n bounds ] [ -M path ] [ -I path ] map dump kerntypes lcrash [ -s dumpdev dumpdir <0 | 1> ]

DESCRIPTION

lcrash is a hands-on utility that generates detailed kernel information in an easy-to-read format. lcrash also provides the ability to generate reports about system crash dumps. Depending on the type of system crash dump, lcrash can create a unique report that contains information about what happened when the system crashed. lcrash can be run on live systems or with any map and dump specified on the command line.

map contains symbol table information needed for symbolic access to the system memory image being examined. The default map is /boot/System.map, which is used when analyzing a live system. If the memory image being analyzed is from a system core dump (dump.N), then map must be a copy of the map file that was valid at the time of the crash.

dump is a file containing the system memory image. The default dump is /dev/mem, which provides access to system memory when analyzing a live system. dump can also be a pathname to a file (dump.N) produced by lcrash run with the -s option.

kerntypes is a file containing kernel type information that lcrash needs in order to properly access kernel data in the system memory image. The default kerntypes is /boot/Kerntypes, which provides access to kernel type information when analyzing a live system. kerntypes can also be a pathname to a file (Kerntypes.N) produced by lcrash run with the -s option.

OPTIONS

-s  Allows a crash report to be created. The memory image is read from dumpdev, which is the dump device where the system dump memory image is placed. The default dumpdev is /dev/vmdump, although it will traditionally be specified out of /etc/sysconfig/dump, which is where /sbin/lkcd reads its configuration variables from. The report will be created and saved into dumpdir. The 0 or 1 variable declaration determines whether the memory image is also saved to disk along with the crash report. For example, some system administrators may only wish to create a crash report, so they would specify 0. Other users may want to perform more detailed analysis of the system failure, and would specify 1. The default value is 1.

-n  Runs using /var/log/dump as the default dump directory, and tries to start lcrash using the files /var/log/dump/<bounds>/map.<bounds> and /var/log/dump/<bounds>/dump.<bounds>. The <bounds> variable is the number of the crash. There is a file in /var/log/dump called 'bounds' that has a number in it. When a crash dump is saved or reported, the 'bounds' index number is incremented so that the next index number is used for the next failure.

-M path
    Specifies the PATH to search for loading macros either on startup or when the 'load' command is issued at the lcrash prompt. On startup all files in these directories are loaded automatically. The default macro path is ~/.lcrash:/usr/share/sial/lcrash. The environment variable LC_MPATH can be used for that perpose also.

-I path
    Specifies the PATH to search for #include directives in macro files. The default value for this path is ~/.lcrash/include:/usr/share/sial/lcrash/include. The environment variable LC_IPATH can be used for that perpose also.

MACROS
C syntax macros can be used to create new commands and expand lcrash's functionality. They can be useful for commands that are specific to a site or engineering group and make it easy for everyone to chip in and expand the base lcrash distribution. Please refer to lkcdutils/README.sial and lkcdutils/libsial/README at http://cvs.sourceforge.net/cgi-bin/cvsweb.cgi/?cvsroot=lkcd for more details on how to write new commands or on the sial interpreter itself (e.g. list of builtin functions, exceptions to the C syntax etc...).

For a quick start, refer to the sample macro ps.sial in /usr/share/sial/lcrash.

NOTES

1)  lcrash is in a continually evolving state; it is important to get the latest lkcd and lcrash RPM/patch files to keep on top of the latest changes.

2)  There are likely a number of bugs, as this is the first release. Please report any and all bugs after reviewing project details located at http://oss.sgi.com/projects/lkcd/.