System Crash

[Ted Flanders]

As you will notice I am new to Unix. My system crashed the other day, my partner rebooted it and all is well, I hope. Where do I go and what (exactly) do I do to see what caused the crash. I know that it will be in a log some where, but which one or which logs. My boss asked me why it crashed and I told him I would find out. A little help here..........please. Thanks!

[Rui Vilao]

Ted,

As a first approach, check the content (and make a backup copy of it because it is overwritten after each
reboot) of:
/usr/adm/syslog/OLDsyslog.log

With the command "uptime" you can know how long
your system has been running so it should be easy
to see if some errors were logged shortly before
the crash.

Regards,

Rui.

[Mark Mitchell]

Take a look at /var/adm/crash and see if a core dump was made. If so, talk to Hp about running a q4 on it to see if any information can be extracted.

[Rita C Workman]

And just as an additional comment, you could also have a hardware issue. Just because the box came back up, does not mean it is hardware..ok.
You may also want to check for any recent files being written to /var/tombstones/ts99.
It's the last one one that counts...check the date. This will show you if you had any hardware issues with HPMC...
Remember, cover all possibilities....
Regards,

[Rick Garland]

Checking the syslog, tombstones, the crash dump file, running the q4, getting HP for more assistance. If you have a HPMC (High Priority Machine Check) you will need to get HP to provide assistance. This is indicative of a HW problem. The techs from HP can analyze the PIM and provide some more definitive answers.

[Devbinder Singh Marway]

Also check the /etc/shutdownlog for any panics messages e.g. reboor after panic ( some values) , these valuse report to HP .

another thing what was running / you doing on the system before it crashed ?

[Bill Hassell]

Unix crashes are a bit tricky to diagnose without help. First, the crash must have been saved (typically /var/adm/crash). If the directory does not exist, then the crash dump has most likely been lost by now. There can be no log kept of the crash because the operating system has termninated and passed control to the processor ROMs for perform a crash dump into the dump area (see lvlnboot -v).

Once the dump has been completed, the processor ROMs will reboot the machine and during the reboot process (part of /sbin/init.d tasks), savecore is run to determine whether a crash dump exists anjd if there is a /var/adm/crash directory. If not, the dump is ignored. Look at /etc/rc.log and serach for savecore entries to see if a crash dump was detected.

If the crash was saved into /var/adm/crash, there willl be 2 files: vmunix.0 and vmunix.1 (multiple files means multiple crashes). Also, savcore writes into /var/adm/shutdownlog the 1-liner to indicate the reason for the crash.

This is the tricky part: panic errors might be data segmentation violation or freeing free frag...correct errors but no indication of the cause except that patches are needed. There mught be an indication that an HPMC occurred (High Priority Machine Check) which inidicates a hardware failure. If PDC code on the processor board is up to date, then the /var/tombstones/ts99 file will provide diagnostic informationn for HP service to fix the problem.

If a software error was detected then you can use q4 to analyze the dump and contact the HP Response Center to read the results. Information on crash dumps can be found at:

ftp://contrib:9unsupp8@hprc.external.hp.com/crash