crash(8) [netbsd man page]

CRASH(8)						    BSD System Manager's Manual 						  CRASH(8)

NAME

     crash -- examine and debug system images

SYNOPSIS

     crash [-M core] [-N kernel]

DESCRIPTION

     The crash command is used to examine and debug system images.

     If run without any arguments, crash operates on the running system.

     The options are as follows:

     -M core	   Operate on the specified crash dump instead of the default /dev/mem.  Crash dumps should be from the same version of the system
		   and same machine architecture as the running version of crash, and must be uncompressed.

     -N kernel	   Extract the name list from the specified kernel instead of the default /dev/ksyms.

     The command syntax used by crash is the same as the in-kernel debugger.  See the ddb(4) manual page for more information.

     Operations and facilities that require a running system, such as breakpoints, are not supported by crash.

     crash does not provide pagination.  However, by using the pipe symbol, output may be sent to commands available from the shell.  For example:

	 crash> ps | more
	 crash> ps | grep ioflush

SEE ALSO

     ps(1), vmstat(1), ddb(4), pstat(8)

HISTORY

     The crash command appeared in NetBSD 6.0.

BSD
								   March 7, 2009							       BSD

CRASH(L)																  CRASH(L)

NAME

       crash - analyze kernel dump or active system image

SYNOPSIS

       crash [ aps ] [ -bdvtiz ] [ -s sfile ] [ -c cfile ] [ -u addr ]

DESCRIPTION

       Synopsis of options -
       -b   Brief mode; skip general display of processes
       -d   Crash dump contains swap image.  (default?)
       -v   Verbose; dump much information about each proc [future]
       -t   TTY structs to be dumpped
       -i   Incore inode table to be printed
       -c FILE	 Provide non-standard file name for system image input
       -s FILE Provide non-standard symboltable input
       -u ADDR	 Trace a process other than currently selected one
       -z   Interrupt Trace displayed
       aps  Print PS & PC at time of interupt (doesn't do anything)

       crash  examines	a  dump  of  unix which it looks for in the file sysdump.  It prints out the contents of the general registers, the kernel
       stack and a traceback through the kernel stack.	If an aps is specified, the ps and pc at time of interrupt are also printed out.  The dump
       of  the	stack commences from a "reasonable" address and all addresses are relocated to virtual addresses by using the value of kdsa6 found
       in the dump.

       The following options may be specified.

       -b     Brief mode; skip general display of processes.  Only the currently selected process will be traced.

       -c cfile
	      If the -c argument is found, the following argument is taken to be the name of a file containing the system image.  The  default	is
	      "/usr/sys/core".

       -s sfile
	      If the -s argument is found the following argument is taken to be the name of a file, containing a symbol table which should be used
	      in interpreting text addresses.  The default is "/unix".

       -u addr
	      Force a process to be displayed as if it were active when the crash occurred.  addr is the octal address of the proc table entry.

FILES

       /unix	     system namelist
       /dev/swap     swap device
       /usr/sys/core core file

SEE ALSO

       crash(8), adb(1), ps(1), rstat(1)

DIAGNOSTICS

       Missing arg Unable to Open file Format Error in symbolfile

BUGS

       Care should be used in running crash on "/dev/mem".  Things can change while crash is running; the picture it gives is only a close approx-
       imation to reality.

AUTHOR

       Mike Muuss, JHU EE
       John Stewart, Teledyne Geotech

								    March 1983								  CRASH(L)