|
|
To run crash to examine a live system, log in as
root and enter the command:
/etc/crash
crash reads the kernel program file for symbol table
information. It obtains the system memory image by opening the
special device file /dev/mem.
If the currently booted kernel is not /unix
(symbolically linked to /stand/unix), you must specify
the pathname of the kernel program file using the -n
option. For example, if the kernel running at the time of the
crash was /stand/unix.old, you would enter:
/etc/crash -n /stand/unix.old
To examine a memory image that you have saved to a file using
ldsysdump(ADM),
you must specify the name of this file using the
-d option. For example, if you have used
ldsysdump to save the memory image to the file
/tmp/dumpfile, you would enter:
/etc/crash -d /tmp/dumpfile
Again, if the currently executing kernel is not the same as
that running when the system crashed, you must specify the name
of the correct kernel program file to crash using the
-n option. For example, if you renamed the
program file for the kernel that crashed as
/stand/unix.crashed, enter:
/etc/crash -d /tmp/dumpfile -n /stand/unix.crashed
See ``Examples of using crash'' for typical instances in which you might use crash.