libcrash.5 (2010 09)
l
libcrash(5) libcrash(5)
NAME
libcrash - crash dump access library
SYNOPSIS
#include <libcrash.h>
int cr_open(const char *path, CRASH **cb, int flags);
int cr_verify(CRASH *crash_cb, int flags);
cr_info_t *cr_info(CRASH *crash_cb);
int cr_uncompress(CRASH *crash_cb, const char *pathname,
uint64_t size, int flags);
int cr_isaddr(CRASH *crash_cb, uint64_t pagenum, int *avail);
int cr_read(CRASH *crash_cb, void *buf, uint64_t mem_page,
int *num_pages);
int cr_set_node(CRASH *crash_cb, int node_num,
int *old_node_num);
void cr_perror(CRASH *crash_cb, int error);
int cr_close(CRASH *crash_cb);
DESCRIPTION
libcrash is a library which provides access to system crash dumps. Access to a dump through the
library is independent of the format of the crash dump (there are several, described below). It is also
independent of the location of the dump, which could be on a raw dump device, in files in a file system, or
a mixture of the two. The memory of a running system can also be treated as a "dump" through use of the
/dev/mem driver.
All accesses to a dump through the library begin with a call to
cr_open(). The crash dump descriptor
returned from this call is a necessary parameter to all of the other libcrash calls. They are:
cr_verify() Verifies the integrity of a dump by checking the sizes and checksums of all of
the files making up the dump.
cr_info() Returns a pointer to a structure containing information about the dump and
the machine and kernel that produced it.
cr_uncompress()
Prepares a file in the crash dump for use, by uncompressing it (if needed) and
validating its size and checksum. This function is used internally by the
library for access to the physical memory image, and can be used by callers for
access to the kernel and kernel module files.
cr_isaddr() Gives information about whether a particular physical memory page was valid
on the machine that dumped, and if so, whether or not that page’s contents
were included in the dump.
cr_read() Reads pages from the dump.
cr_set_node() Sets the node number that is used by cr_read() and cr_isaddr() to
access memory in the node private memory areas.
cr_perror() Prints to standard error an error or warning message corresponding to one of
the error or warning codes returned by another library call.
cr_close() Terminates access to the crash dump and frees all space allocated by the
library.
Each of the above calls has its own manual page, describing its usage more fully.
Crash Dump Formats
There are four current formats of system crash dumps:
COREFILE (Version 0) This format, used up through HP-UX 10.01, consists of a single file containing
the physical memory image, with a 1-to-1 correspondence between file offset and memory
address. Usually there is an associated file containing the kernel image.
COREDIR (Version 1) This format, used in HP-UX 10.10, 10.20, and 10.30, consists of a core.n
directory containing an INDEX file, the kernel (vmunix) file, and numerous core.n.m
files, which contain portions of the physical memory image.
HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1