System Crash

[Ted Flanders]

As you can tell by this question, I am new to HPUX. I run a HP9000 K220 and it crashed the other day after I left work. My partner rebooted and it seemed to be fine. Where do I go and exactly what do I look at to determine the exact reason for the crash? Please be specific. Thanks!!

[Stefan Farrelly]

Take a look in /var/adm/shutdownlog, is there an entry for the crash - looks something like panic 0xYYZZZ ? Any entries in there which are not normal REBOOT messages for the date of the crash ?

Take a look in /var/tombstones, do an ll -tr, is there a file in there of the date of the crash ? if so this will have the info we may need to analyse the panic.

Is there a system crashdump in /var/adm/crash ? a file called bounds may be there with a directory called crash.X ? is the date of them match the date of the crash ? (date on when these files were created)

Any errors in /var/adm/syslog/syslog.log from the date+time of the crash ?

Does the file /var/adm/msgbuf exist ? if so whats the date on the file (ls -l), is from the date/time of the crash ? if so keep this file, copy it to a safe place. Does the file /var/adm/OLDmessages exit ? if so copy this to a safe place also and take a look at it, go the bottom of this file and we may have some error messages in it which will help to determine the error.

[Ted Flanders]

Stefan, I am going to work in a little bit. Wow, great information, I cant wait until I am that good with Unix! I have printed out your advice and will go and try it now. Thank you!

[Ted Flanders_1]

Come to find out, with everyones help, this was not a systems crash. It was a software crash and someone here (other than me) rebooted the system. Even though it wasnt a system crash, I learned a lot and found out some things that I need to get done before we really do have a system crash. Thanks all!

[Stefan Farrelly]

Ted, dont forget to assign points then to all those who helped you (from this question and its duplicate which had lots of replies).

[Andy Monks]

Assuming you find a 'crash' or 'core' directory in /var/adm/crash, what you can do is the following :-

cd into the directory (so /var/adm/crash/core.X or crash.X)

then do

/usr/contrib/bin/q4 .

At the q4 prompt do :-

trace -u event 0

and post the result here.

[alberto vasquez]

I would also check /var/adm/syslog/OLDsyslog.log
Once the system reboots it will move
syslog.log to the OLDsyslog.log, so it
may have info logged from right before
or at the time of the crash.


S.