core analysis

[f. halili]

what can i use to analyze a core file?

thanks,
f. halili

[Pete Randall]

simplest: strings core


Pete

[f. halili]

already using #strings core. what other tools or commands can i use....

[A. Clay Stephenson]

"file core" to identify the executable and then, by far, the best tool is a debugger (gdb, xdb, ...) to do a stack trace. The stack trace allows you to see the chain of functions which led up to the crash.

[Rick Garland]

file core is an option

If from a system crash, can run the Q4 utility againest it.

[Ranjith_5]

Hi Halili,

HP-UX will attempt to create a snapshot of physical memory and register contents before it stops running. This snapshot can assist engineers in determining the cause of the problem because it holds a record of what the system was doing at the time it crashed. The correct name for this snapshot is a core dump. The default location for this snapshot is the primary swap area, but it is possible to configure systems to put the snapshot on another disk device. See the System Administration Tasks manuals for the Series 700 and the Series 800 for information on configuring dump devices.

Find more info here..

http://docs.hp.com/en/J2237-90005/ch06s05.html


regards,
Syam

[f. halili]

the core was created by an application...
i don't want to run the app, but would like to do some analysis base on the core file....

[Bill Hassell]

If you want to see what program caused the core file, use the file command:

file /some_directory/core

If you don't have the source code or know how rewrite the program, that's the only useful tool. You can use various analysis tools that will show stack traces and register settings at the time of the program failure but they won't be of any use without the source code and a knowledge of the programming language used to create the program. If it is an HP program, most likely you are not up to date on patches.

[Ranjith_5]

Hi Halili,

Setting Up Your System To Save a Core Dump
============================================

In order to have system core dumps saved automatically during boot-up, the savecore function must be enabled in the system's /etc/rc.config file. Search this file for the string SAVECORE and follow the instructions in the comments.

Manually Getting a Core File from the Swap Partition
========================================================


If savecore() was not run at boot-up, or did not succeed, you can still run savecore(1m) manually by taking the following steps:


/usr/bin/bdf # find enough space for the dumpmkdir
/tmp/syscore # assuming /tmp has enough space/


Regards,
Syam

[Ranjith_5]

Run the following to save the core file.

#usr/sbin/savecore /tmp/syscore


Regards,
Syam

[A. Clay Stephenson · Accepted solution]

This is an application crash not an OS crash. All the stuff about savecove, q4, etc. does not apply. If you have a programming background then a stack trace under a debugger is by far the most useful tool.

[f. halili]

thanks for all the inputs