topic Re: core analysis in Operating System - HP-UX

core analysis

f. halili — Thu, 10 Feb 2005 12:00:21 GMT

what can i use to analyze a core file?

thanks,
f. halili

Re: core analysis

Pete Randall — Thu, 10 Feb 2005 12:01:36 GMT

simplest: strings core

Pete

Re: core analysis

f. halili — Thu, 10 Feb 2005 12:03:51 GMT

already using #strings core. what other tools or commands can i use....

Re: core analysis

A. Clay Stephenson — Thu, 10 Feb 2005 12:04:23 GMT

"file core" to identify the executable and then, by far, the best tool is a debugger (gdb, xdb, ...) to do a stack trace. The stack trace allows you to see the chain of functions which led up to the crash.

Re: core analysis

Rick Garland — Thu, 10 Feb 2005 12:05:20 GMT

file core is an option

If from a system crash, can run the Q4 utility againest it.

Re: core analysis

Ranjith_5 — Thu, 10 Feb 2005 12:05:50 GMT

Hi Halili,

HP-UX will attempt to create a snapshot of physical memory and register contents before it stops running. This snapshot can assist engineers in determining the cause of the problem because it holds a record of what the system was doing at the time it crashed. The correct name for this snapshot is a core dump. The default location for this snapshot is the primary swap area, but it is possible to configure systems to put the snapshot on another disk device. See the System Administration Tasks manuals for the Series 700 and the Series 800 for information on configuring dump devices.

Find more info here..

http://docs.hp.com/en/J2237-90005/ch06s05.html

regards,
Syam

Re: core analysis

f. halili — Thu, 10 Feb 2005 12:14:14 GMT

the core was created by an application...
i don't want to run the app, but would like to do some analysis base on the core file....

Re: core analysis

Bill Hassell — Thu, 10 Feb 2005 12:17:53 GMT

If you want to see what program caused the core file, use the file command:

file /some_directory/core

If you don't have the source code or know how rewrite the program, that's the only useful tool. You can use various analysis tools that will show stack traces and register settings at the time of the program failure but they won't be of any use without the source code and a knowledge of the programming language used to create the program. If it is an HP program, most likely you are not up to date on patches.

Re: core analysis

Ranjith_5 — Thu, 10 Feb 2005 12:52:45 GMT

Hi Halili,

Setting Up Your System To Save a Core Dump
============================================

In order to have system core dumps saved automatically during boot-up, the savecore function must be enabled in the system's /etc/rc.config file. Search this file for the string SAVECORE and follow the instructions in the comments.

Manually Getting a Core File from the Swap Partition
========================================================

If savecore() was not run at boot-up, or did not succeed, you can still run savecore(1m) manually by taking the following steps:

/usr/bin/bdf # find enough space for the dumpmkdir
/tmp/syscore # assuming /tmp has enough space/

Regards,
Syam

Re: core analysis

Ranjith_5 — Thu, 10 Feb 2005 12:55:01 GMT

Run the following to save the core file.

#usr/sbin/savecore /tmp/syscore

Regards,
Syam

Re: core analysis

A. Clay Stephenson — Thu, 10 Feb 2005 12:57:45 GMT

This is an application crash not an OS crash. All the stuff about savecove, q4, etc. does not apply. If you have a programming background then a stack trace under a debugger is by far the most useful tool.

Re: core analysis

f. halili — Thu, 10 Feb 2005 13:01:00 GMT

thanks for all the inputs