about /var/adm/crash

[leyearn]

how can analyse the file /var/adm/crash

[Norman_21 · Accepted solution]

cd to where the crash files are located e.g):

#cd /var/adm/crash/crash.x

# gunzip vmunix.gz

# /usr/contrib/bin/q4prep -p

# q4 -p . < note the "dot" at the end of the command>


then

q4> trace event 0 > trace.out

q4> include analyze.pl
(note letter "l" not digit 1)

q4> run Analyze AU >> ana.out
(NOTE: ctrl-c will interrupt q4)

q4> exit

* Determine if a hardware problem induced the crash.
If the ana.out or trace.out contains references to an
HPMC occurring, the cause of the crash was very likely
a hardware fault*

Type:
# grep HPMC ana.out trace.out

Check for:
" crash event was an HPMC"
or
"Crash Event 0 (HPMC, struct
crash_event_table_struct..."
If either of this lines appear, open a hardware repair
request with the hardware support organization for
this system.

Also, send the /var/tombstones/ts* file (if that
directory exists) matching the "dumptime" listed in
the INDEX file. It may well have the hardware fault
codes that can aid in isolating the hardware cause.

Generate a patch list:

#swlist -l product|grep -i PH > patches.out

Send the following files to hpcu@atl.hp.com using the
SOFTWARE CASE ID as the subject:

ana.out
patches.out
trace.out
what.out ( if created)
/etc/shutdownlog
/var/tombstones/ts* (if HPMC was detected)

NOTE:
The hpcu E-Mail box has a 3MB maximum mail size!

[charles butkus]

Also, if your system reboots itself, DO NOT power it off and back on. If it comes back up, and you've power cycled it, you will NOT have a good tombstone to look at (you can vi them..) or send to HP... Fully powering off the system clears the data out of the hardware.. /var/adm/crash comes from the swap area, I believe.


-Charles

[Norman_21]

You /var file system has to have enough space, at least the same amount of the Physical memory in order to get a complete crash files. Otherwise, your /var file system will get full and you'll never be able to analyse the crash files because they are incomplete..
You may change the location of the crash files in the following:
/etc/rc.config.d/savecrash
# SAVECRASH=1 [uncomment out the line]
# SAVECRASH_DIR=/var/adm/crash [change the location as desired where you have enough space]

Hope this help

[Jeff Schussele]

Hi,

The INDEX file has the most info for the average user. For most all the other files one must have a good knowledge of the q4 utilities.

Rgds,
Jeff