topic Re: Crash dump analysis in Operating System - HP-UX

Crash dump analysis

Stéphane Lachapelle_1 — Mon, 02 Apr 2001 14:39:20 GMT

Hi

My system L1000 crashed. It dumped something in /var/adm/crash/crash.1.

How to analyse the crash file using q4?

TIA, Stef

Re: Crash dump analysis

Vincenzo Restuccia — Mon, 02 Apr 2001 14:46:54 GMT

You have the files .z gunzip it and analyse with strings.

Re: Crash dump analysis

Rita C Workman — Mon, 02 Apr 2001 14:57:30 GMT

I haven't had a crash in quite awhile (..maybe I shouldn't say that though..cause you know what will happen), but I came across this thread with lots of links and some pointers on doing this. I just haven't had occassion to give it a try. Maybe it will help you:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0x698c0559ff7cd4118fef0090279cd0f9,00.html

Regards,
/rcw

Re: Crash dump analysis

Steffi Jones_1 — Mon, 02 Apr 2001 15:13:48 GMT

Hello Stephane,

there is a lot of docs out on www.docs.hp.com. I did a seach on q4 and crash and it came up with a lot of links. That would be a good start point for you.

Other than that check for the INDEX file in the directory.
If you see it mentioning HPMC then you have most likely a hardware issue.

Q4 can be very complex and it might make really sense to open a response center call so that they can determine what went wrong before it happened again.

Steffi Jones

Re: Crash dump analysis

nancy rippey — Mon, 02 Apr 2001 15:38:06 GMT

Re: Crash dump analysis

Mark Mitchell — Mon, 02 Apr 2001 16:11:37 GMT

Re: Crash dump analysis

melvyn burnard — Mon, 02 Apr 2001 17:08:22 GMT

quick simple suggestion, what does:
tail /etc/shutdownlog
reveal??
also, what does your INDEX file say?
It will probably be quickest to log a call with your HP Response Centre and get the dump analysed properly.

Re: Crash dump analysis

federico_3 — Tue, 03 Apr 2001 05:36:06 GMT

you coulduse the "adb" comand afterwards you have converted the dump to readable format for adb.

# crashutil -v COREFILE /var/adm/crash/crash.0 /tmp/corefile /tmp/kernelfile
# cd /tmp
# adb -k kernelfile corefile
msgbuf+8/s
. . . .
. . . .
q
#

Re: Crash dump analysis

Printaporn_1 — Tue, 03 Apr 2001 09:10:32 GMT

Hi,

Normally you can send core file to HP solution center Engineer to help but in addition after you can run
q4 -p

run
include Analyze.pl
run analyze UAP > file

after finish exit from q4 and vi file
you can find stack trace and panic info.
if you search for panic or TOC , you can find system call that cause panic, then search in Knowledge base , normally it will end with install some patches.

Regards,

Re: Crash dump analysis

Printaporn_1 — Tue, 03 Apr 2001 09:39:36 GMT

Hi Stef,

Again conclusion steps by steps.
HP-UX 11.0 already have q4 package in /usr/contrib/bin

1. cd /var/adm/crash/crash.0
#/usr/contrib/bin/q4prep
q4 library files being created in /var/adm/crash/crash.0/q4lib

2.cd q4lib
#cp sample.q4rc.pl ~/.q4rc.pl
3. cd ..
#q4 -p
@(#) q4 $Revision: 1.79a $ $Date: 97/09/08 12:00:22 $ 0
Reading kernel symbols ...
Reading kernel data types ...
Initialized PA-RISC 2.0 address translator ...
Initializing stack tracer ...
Get the latest Q4 news by typing "news".

q4> include analyze.pl
loading ./q4lib/analyze.pl ...
loading ./q4lib/uname.pl ...
loading ./q4lib/misc.pl ...
loading ./q4lib/uptime.pl ...
loading ./q4lib/adjust.pl ...
loading ./q4lib/messagebuffer.pl ...
loading ./q4lib/addresses.pl ...
loading ./q4lib/tables.pl ...
loading ./q4lib/processors.pl ...
loading ./q4lib/crashes.pl ...
loading ./q4lib/rpb.pl ...
loading ./q4lib/traces.pl ...
loading ./q4lib/globals.pl ...
loading ./q4lib/processes.pl ...
loading ./q4lib/commands.pl ...
loading ./q4lib/credentials.pl ...
loading ./q4lib/threads.pl ...
loading ./q4lib/user.pl ...
loading ./q4lib/vm.pl ...
loading ./q4lib/vm_vfddbd.pl ...
loading ./q4lib/files.pl ...
loading ./q4lib/vfs.pl ...
loading ./q4lib/inode.pl ...
loading ./q4lib/buf.pl ...
q4>run Analyze UAP > ana.out

-----
then waiting till finish , or in another session
cd /var/adm/crash/crash.0
vi ana.out
search for stack

Stack trace from the first crash event:
stack trace for event 0
crash event was a TOC
FUNC PC SP FMP SSP
idle+0xa78 0.0x135a60 0.0x0'0d20c1f0 0.0x0'0d20c1e0 n/a
swidle_exit+0x0 0.0x1380ac 0.0x0'0d20c050 0.0x0'0d20c040 n/a

---------------
in my case there is TOC ,
from crash event you can find something,
Hope this help,

Re: Crash dump analysis

Bill McNAMARA_1 — Tue, 03 Apr 2001 13:09:51 GMT

See attached zip file for a beginners guide
in html format

Bill

Re: Crash dump analysis

Stéphane Lachapelle_1 — Tue, 03 Apr 2001 17:54:03 GMT

Thanks to everybody.

The better answer was given by Mark Mitchell.

I have a HPMC error du to a pocessor error. HP tech will change it soon.

Stef