Red Hat ENTERPRISE LINUX 5.4 - SYSTEMTAP BEGINNERS GUIDE : System information : Page 229

kexec and kdump 215

If you decide to analyze the dump on another machine, you must check both the ar-

chitecture of the computer and the files necessary for debugging.

You can analyze the dump on another computer only if it runs a Linux system of the

same architecture. To check the compatibility, use the command uname -i on both

computers and compare the outputs.

If you are going to analyze the dump on another computer, you also need the appro-

priate files from the kernel and kernel debug packages.

1 Put the kernel dump, the kernel image from /boot, and its associated debugging

info file from /usr/lib/debug/boot into a single empty directory.

2 Additionally, copy the kernel modules from /lib/modules/$(uname -r)/

kernel/ and the associated debug info files from /usr/lib/debug/lib/

modules/$(uname -r)/kernel/ into a subdirectory named modules.

3 In the directory with the dump, the kernel image, its debug info file, and the mod

ules subdirectory, launch the crash utility: crash vmlinux-version vm-

core.

NOTE: Support for Kernel Images

Compressed kernel images (gzip, not the bzImage file) are supported by

SUSE packages of crash since SUSE® Linux Enterprise Server 11. For old-

er versions, you have to extract the vmlinux.gz (x86) or the vmlinuz

(IA64) to vmlinux.

Regardless of the computer on which you analyze the dump, the crash utility will pro-

duce an output similar to this:

tux@mercury:~> crash /boot/vmlinux-2.6.32.8-0.1-default.gz

/var/crash/2010-04-23-11\:17/vmcore

crash 4.0-7.6

This program is free software, covered by the GNU General Public License,

and you are welcome to change it and/or distribute copies of it under

certain conditions. Enter "help copying" to see the conditions.