General Usage

Lcrash HOWTO
Prev |  | Next

# Chapter 3. General Usage

# 3.1. Invoking Lcrash

Three input files are needed for lcrash:

- a map file providing the symbol table of the Kernel,

- a dump file containing the image of a system's memory to be analyzed,

- an object file in "stabs" debug format providing information of Kernel data types. [1]

Currently lcrash uses positional arguments. To invoke lcrash you can use the following command line: lcrash `symbol-table` `dump-file` `kern-types`

Lcrash knows defaults for its arguments. They are given in table Table 3-1.

Table 3-1. Default values

Parameter | Default
--- | ---
`symbol-table` | `/boot/System.map`
`dump-file` | `/dev/mem`
`kern-types` | `/boot/Kerntypes`

If you are happy with all default values you can call lcrash without any arguments - as shown in the following example.

Example 3-1. Starting Lcrash

    bash# lcrash
    map = /boot/System.map, vmdump = /dev/mem, outfile = stdout, kerntypes = /boot/Kerntypes

    Please wait...
        Loading system map .................... Done.
        Loading type info (Kerntypes) ... Done.
        Loading ksyms from dump ...... Done.
    >>

Lcrash only works correctly if `symbol-table`, `kern-types` and `dump-file` are from the same Kernel.

The `System.map` file is generated automatically when the Kernel is built. It contains symbol names of the Kernel and their corresponding Kernel addresses. Normally it is installed under `/boot/System.map`.

The file `/dev/mem` is used for analyzing the running Linux system. For parameter `dump-file` you can specify a file containing a dump that was generated with dump tools (see chapter \ref{chapter:DumpTools}).

The `Kerntypes` file is also generated in the Kernel build. But since `Kerntypes` is not in the standard Linux tree it is necessary to apply a specific "Kerntypes patch" before. The `Kerntypes` file is compiled with the `-gstabs` compile option which generates type information for all types defined in the Kerntypes source file. In the Kerntypes source file there are several includes for Kernel header files with important Kernel structures.

The mentioned "Kerntypes patch" and the s390 dump tools can be downloaded from http://oss.software.ibm.com/developerworks/opensource/linux390/exp_src.html

### Notes

[1] | In fact lcrash uses only type information contained in the "stabs" format. Further debug information of this format is not used. For more information about the "stabs" format please refer to [stabs1997].

Prev | Home | Next
LKCD CVS Repository |  | User Interface