crash(8)crash(8)Namecrash - examine system images
Syntax
/usr/bin/crash [ system ] [ namelist ]
Description
The utility is an interactive program that lets you examine the core
image of the operating system. This utility has facilities for inter‐
preting and formatting the various control structures in the system and
certain miscellaneous functions that are useful when perusing a dump.
The arguments to the utility are the file name where the system image
can be found and a namelist file to be used for symbol values.
The default values are and hence, the utility specified without argu‐
ments can be used to examine an active system. If a system image file
is given, it is assumed to be a system core dump and the default
process is set to be that of the process running at the time of the
crash. This is determined by a value stored in a fixed location by the
dump mechanism.
Commands
Use the following input to the utility:
command [ options ] [ structures ]
If used, options modify the format of the printout. If a specific
structure element is not specified, all valid entries are used. For
example, proc 12 15 3 prints only process table slots 12, 15, and 3,
but proc prints the entire process table in standard format.
In general, those commands that perform I/O with addresses assume hexa‐
decimal on 32-bit machines and octal on 16-bit machines.
The commands include the following:
user [ -a ] [ process table entry ] [ *proc address ] [ #pid ]
Aliases:
Prints the user structure of the named process as determined by
the information contained in the process table entry. If an
entry number is not given, the information from the last execut‐
ing process is printed. Swapped processes produce an error mes‐
sage since their uareas are swapped. If the -a option is speci‐
fied, the entire user structure is printed in a vertical format
with the structure field selector names printed first, followed
by their value. The -a format prints many fields that are not
printed when -a is not specified.
ufile [ process table entry ] [ *proc address ] [ #pid ]
Prints the open file table for the given process.
trace [ - ] [ process table entry ] [ *proc address ] [ #pid ] [%cpu-
number ]
Aliases:
Generates a kernel stack trace of a process. The process is
either a process slot number, an address of process slot, or the
running process. If the process is not running, the trace
begins at the If an entry number is not given, the information
from the last executing process will be printed. It is not pos‐
sible to trace the executing process on a running system. Using
the - flag allows the registers and variables for each stack
frame to be dumped. When %cpu-number is specified, a trace of
the running process on the specified CPU is performed. The
%cpu-number cannot be specified in the same trace command as the
process slot number, the process slot address, or the process-
id.
stack [ -v ] [ process table entry ] [ *proc address ] [ #pid ]
Aliases :
Generates a kernel stack dump of a process. This is an unfor‐
matted display of the kernel stack. If -v is specified, a for‐
matted display of the VAX kernel stack is given, including saved
registers, arguments, and kernel backtrace. For RISC proces‐
sors, the -v option is accepted but has no effect.
proc [ -a] [ -r] [ process table entry ] [ *proc address ] [ #pid ]
Aliases:
Formats the process table. The -a option causes all of the
fields of the process table to be printed in a vertical with the
structure field selector names first printed, followed by their
value. The -a option prints many fields that are not printed
when -a is not specified. The -r option causes only runnable
processes to be printed.
proclock [ -r] [ process table entry ] [ *proc address ] [ #pid ]
Shows the SMP sleep locks held by a non-running process. Same
optional arguments as proc.
pcb [ process table entry ] [ *proc address ] [ #pid ]
Prints the process control block of the current process. The
process control block is a part of the user area (VAXen only).
If no entry number is given, the information from the last exe‐
cuting process will be printed.
ps [ process table entry ] [ *proc address ] [ #pid ]
Prints the process slots, process id's, and process names for
all processes.
pcb [ process table entry ] [ *proc address ] [ #pid ]
Prints the process control block for the given process.
ppte [ process table entry ] [ *proc address ] [ #pid ]
Prints the pte's associated with the given process.
spt Dumps the system page table.
cmap -A
Prints all of the cmap entries.
cmap <page frame number>
Prints the memory freelist or the cmap for the given PFN.
cmap -i index
Prints the core map for the given coremap index.
cmap -h index
Prints the core maps for the given hash starting at index.
cmap -b block
Prints the core maps hashed on the given block.
cmap -a at
Prints the core map at the given address.
cpu [ -a ]
Prints the cpudata table. If -a is specified, all of the
fields in the table are printed in vertical format.
smem Prints shared memory table information. Shared memory configu‐
ration information is printed, along with the contents of the
shared memory table, for all allocated shared memory segments.
Then, for each allocated shared memory segment, information is
printed about processes associated with the shared memory seg‐
ment, and consistency checks are performed to verify that the
various data structures linking processes are correct.
shmem shmaddr
Prints information on the shared memory segment at location
shmaddr .
prshmem [ process table entry ] [ *proc address ] [ #pid ]
Prints information on all shared memory segments associated with
the process.
gnode [ - ] [ gnode table entries ] [ *gnode address ]
Aliases:
Formats the gnode table.
gnode -maj <major number>
Formats all gnodes with the given major number.
gnode -min <minor number>
Formats all gnodes with the given minor number.
gnode -fs <mount slot number>
Formats all gnodes for a given file system slot.
gnode -gno <gnode number>
Formats all gnodes with the given gnode number.
gnode -uid <user id>
Formats all gnodes owned by the given uid.
gnode -gid <group id>
Formats all gnodes owned by the given gid.
gnode -lmod <file permissions>
Formats all gnodes with the given protection. The command gnode
-lmod 777 finds all gnodes that allow read/write/execute permis‐
sion to every one.
gnode -hmod <file type>
Formats all gnodes with the given file type. gnode -hmod 2 find
all gnodes that are character special files.
gnode -amod <file modesfR>
Formats all gnodes that match the given modes exactly. The com‐
mand gnode -amod 20777 finds all gnodes for character devices
that allow read/write/execute permission to every one.
gnode -all
Displays a more extensive list of the gnodes contents.
gnode -lock
Shows the SMP lock contained in the gnode.
gfree Prints the list of all inactive gnodes.
block [ - ] [ gnode table entries ] [ *gnode address ]
Prints the gnode data block addresses.
rnode [ gnode table entries ] [ *gnode address ]
Alias:
Prints the associated rnode values for gnodes that are remote
(via NFS).
file [ file table entries ] [ *file address ]
Alias:
Formats the file table.
cred address
Prints the credentials at the given address.
crred address
Verifies the references of a credential at the given address.
crcheck
Verifies all references to all credentials.
mount [ -s ] [ mount table entries ] [ *mount address ]
Aliases:
Formats the mount table. The option gives an abbreviated for‐
mat.
fsdata [ mount table entries ] [ *mount address ]
Alias:
Prints the fsdata structure associated with a mount entry.
mntinfo [ mount table entries ] [ *mount address ]
Alias:
Prints the mntinfo data structure associate with an NFS file
system.
buf [ - ] [ buffer headers ] [ *buffer header address ]
Aliases:
Formats the system buffer headers. By using the - option, all
buffer headers (including ones marked invalid) are printed.
bufgp [ gnode slots ] [ *gnode address ]
Alias:
Prints the buffer headers associated with the given gnode.
buflock
Prints the buffer headers on the locked list.
buflru Prints the buffer headers on the lru list.
bufage Prints the buffer headers on the aged list.
bufempty
Prints the buffer headers on the empty list.
buffer [ format ] [ list of buffers ]
Alias:
Prints the data in a system buffer according to format. If for‐
mat is omitted, the previous format is used. Valid formats
include and The last creates a file in the current directory
(see the Files section) containing the buffer data.
text [ text table entries ] [ *text address ]
Aliases:
Formats the text table.
ftext Alias:
Prints the list of free texts.
callout
Aliases:
Prints all entries in the callout table.
arp [ - ] [ address ]
Prints the arp table. The - option prints the entire table.
socket [ file slot ] [ *file address ]
Prints the socket structure associated with the given file slot.
tty [ - ] [ process slot ] [ *proc address ] [ #pid ]
Alias:
Prints the terminal structure attached to a process. The -
option allows for the raw, cannonical, and output clists.
tty -clist
Includes clists in display of the tty struct.
tty -addr address
Prints the contents of a tty structure at the specified address.
map [ map names ]
Formats the named system map structures.
nm [ symbols ]
Prints the symbol value and type as found in the namelist file.
ts [ text addresses ]
Finds the closest text symbols to the given addresses.
ds [ data addresses ]
Finds the closest data symbols to the given addresses.
od [ symbol name or address ] [ count ] [ format ]
Aliases:
Dumps count data values starting at the symbol value or address
given according to format. Allowable formats are or
dis address [ address ]
Disassembles starting at the first address and continuing until
the second address. These addresses may be symbolic (that is,
syscall+33).
stat Displays DNLC and namei cache statistics.
wg Displays NFS write gathering and UFS clustering statistics.
nfsstat
Displays NFS server statistics.
nfsd Displays NFS server daemon (nfsd) statistics.
dupreq Displays the contents of the duplicate request cache. This is
useful in finding out the recent history of NFS requests made to
the server.
mbuf address
Displays the chain starting at the given address.
inpcb -udp -tcp
Displays the chain of the corresponding protocol, or both TCP
and UDP if no protocol is specified.
client Displays the client table, which contains client handles used to
initiate rpc requests.
sync Resynchronizes the proc, mount, gnode, buffer, file and other
internal tables up to the current state of This command is use‐
ful for looking at changing values in runing kernels. However,
you should not use it when looking at files.
svcxprt address
Prints the svcxprt structure located at address.
scs Traverses data structures in the System Communications Services
(SCS) tree and displays the contents of the data structures.
scs -cb address
Displays the contents of an SCS connection block data structure
at the specified address.
scs -cib address
Displays the contents of an SCS connection information block
data structure at the specified address.
scs -pb address
Displays the contents of an SCS path block data structure at the
specified address.
scs -pib address
Displays the contents of an SCS path information block data
structure at the specified address.
scs -sb address
Displays the contents of an SCS system block data structure at
the specified address.
scs -sib address
Displays the contents of an SCS system information block data
structure at the specified address.
scsi Prints SCSI controller information.
scsi -target
Prints SCSI target information.
scsi -devtab
Prints SCSI devtab information.
scsi -trans
Prints SCSI transfer information.
scsi -cmd
Prints SCSI message or command data.
scsi -bbr
Prints SCSI Bad Block Replacement data.
scsi -error
Prints SCSI error information.
scsi -sii
Prints SCSI SII information.
scsi -dct
Prints SCSI DCT statistics.
scsi -spin
Prints SCSI SPIN statistics.
scsi -all
Prints all SCSIBUS information.
lock [-all] address
Prints the SMP lock structure located at address. The all flag
displays all global SMP locks.
mscp Traverses both the mscp disk and tape subsystems, and prints the
data structures for class blocks, connection blocks, unit
blocks, and active request blocks.
mscp -disk
Traverses the mscp disk subsystem and prints the data structures
for the mscp class block, mscp connection blocks, mscp unit
blocks, and active request blocks.
mscp -tape
Traverses the tmscp tape subsystem and prints the data struc‐
tures for the tmscp class block, tmscp connection blocks, tmscp
unit blocks, and active request blocks.
mscp -config
Traverses both the mscp disk and tape subsystems, and displays
the system configuration. This is done by printing summary
information from the class, connection, and unit blocks.
mscp -connb address
Prints the contents of an mscp connection block at the specified
address.
mscp -classb address
Prints the contents of an mscp class block at the specified
address.
mscp -unitb address
Prints the contents of an mscp unitb block at the specified
address.
mscp -reqb address
Prints the contents of an mscp request block at the specified
address.
mscp -dtable
Displays all the elements of the mscp disk unit table. Unused
elements of the array will be specified as NULL.
mscp -ttable
Displays all the elements of the tmscp tape unit table. Unused
elements of the array will be specified as NULL.
! Escapes to the shell.
#[ history ]
Repeats the last command. If a number is given (that is, #5),
that command number is re-executed.
#h Alias:
Shows the history list.
q Exits from
? Prints a synopsis of commands.
Aliases
There are built-in aliases for many of the formats as well as those
listed for the commands. Some of them are:
byte b.
character char, c.
decimal dec, e.
directory direct, dir, d.
hexadecimal hexadec, hex, h, x.
gnode gno , g.
longdec ld, D.
longoct lo, O.
octal oct, o.
write w.
Restrictions
Many of the flags are abbreviated making them difficult to interpret.
A source listing of the system header files would be helpful when using
the utility.
Examing the stack of the current process on a running system and procs
running at the time of a crash does not work.
Files
Header files for table and structure information
Default system image file
Default namelist file
Files created containing buffer data
See Alsomount(8), nm(1), ps(1), sh(1), stty(1), pstat(8)
VAX crash(8)