Studying a panic

The following list outlines the process for determining which kernel component caused a system panic. For detailed information about interpreting crash(ADM) output, see ``Using the crash(ADM) diagnostic tool''.

1. PANICBOOT=NO must be set in the /etc/default/boot file for this to work.

2. When the system panics, write down the type of panic (see the trap(M) manual page), the EIP number, and the size of the dump in pages from the console display.

3. When the machine reboots, save the kernel dump that is on the dump device as shown in ``Recovering from a system panic''.

4. Put the machine in single-user mode.

5. Run crash(ADM) on the image.

6. Use the panic command in crash to find the routine in which the panic happened. Be sure to verify that the trap type and EIP match those copied from the console screen after the panic.

7. Note the name (symbol name) of the routine that was executing when the system panicked. This is the function listed first under the Kernel Stack before Trap line.

8. Quit the crash command.
   

9. Use strings(C) or nm(CP) to determine the driver in which that routine is located. You can run a script such as the following, which uses strings.

   :
    for FILE in `find /etc/conf/pack.d -name '*.[oa]' -print`
    do
        strings $FILE | grep $1 && echo $FILE
    done
   

   If this script were installed as findpanic, you would run it with one argument that gives the name of the kernel routine:

      findpanic symbol_name
   

   This script will output something like:

      routine_name
      /etc/conf/pack.d/foo/Driver.o
   

   This indicates that the foo driver may have been responsible for the system panic.