crash(8) System Manager's Manual crash(8)
Name
crash - examine system images
Syntax
/usr/bin/crash [ system ] [ namelist ]
Description
The utility is an interactive program that lets you examine the core image of the operating system. This utility has facilities for inter-
preting and formatting the various control structures in the system and certain miscellaneous functions that are useful when perusing a
dump.
The arguments to the utility are the file name where the system image can be found and a namelist file to be used for symbol values.
The default values are and hence, the utility specified without arguments can be used to examine an active system. If a system image file
is given, it is assumed to be a system core dump and the default process is set to be that of the process running at the time of the crash.
This is determined by a value stored in a fixed location by the dump mechanism.
Commands
Use the following input to the utility:
command [ options ] [ structures ]
If used, options modify the format of the printout. If a specific structure element is not specified, all valid entries are used. For
example, proc 12 15 3 prints only process table slots 12, 15, and 3, but proc prints the entire process table in standard format.
In general, those commands that perform I/O with addresses assume hexadecimal on 32-bit machines and octal on 16-bit machines.
The commands include the following:
user [ process table entry ] [ *proc address ] [ #pid ]
Aliases:
Prints the user structure of the named process as determined by the information contained in the process table entry. If an entry
number is not given, the information from the last executing process is printed. Swapped processes produce an error message since
their uareas are swapped.
ufile [ process table entry ] [ *proc address ] [ #pid ]
Prints the open file table for the given process.
trace [ - ] [ process table entry ] [ *proc address ] [ #pid ]
Aliases:
Generates a kernel stack trace of a process. The process is either a process slot number, an address of process slot, or the run-
ning process. If the process is not running, the trace begins at the If an entry number is not given, the information from the last
executing process will be printed. It is not possible to trace the executing process on a running system. Using the - flag allows
the registers and variables for each stack frame to be dumped.
stack [ process table entry ] [ *proc address ] [ #pid ]
Aliases :
Generates a kernel stack dump of a process. This is an unformatted display of the kernel stack.
proc [ -r] [ process table entry ] [ *proc address ] [ #pid ]
Aliases:
Formats the process table. The -r option causes only runnable processes to be printed.
proclock [ -r] [ process table entry ] [ *proc address ] [ #pid ]
Shows the SMP sleep locks held by a non-running process. Same optional arguments as proc.
pcb [ process table entry ] [ *proc address ] [ #pid ]
Prints the process control block of the current process. The process control block is a part of the user area (VAXen only). If no
entry number is given, the information from the last executing process will be printed.
ps [ process table entry ] [ *proc address ] [ #pid ]
Prints the process slots, process id's, and process names for all processes.
pcb [ process table entry ] [ *proc address ] [ #pid ]
Prints the process control block for the given process.
ppte [ process table entry ] [ *proc address ] [ #pid ]
Prints the pte's associated with the given process.
spt Dumps the system page table.
cmap <page frame number>
Prints the memory freelist or the cmap for the given PFN.
cmap -i index
Prints the core map for the given coremap index.
cmap -h index
Prints the core maps for the given hash starting at index.
cmap -b block
Prints the core maps hashed on the given block.
cmap -a at
Prints the core map at the given address.
gnode [ - ] [ gnode table entries ] [ *gnode address ]
Aliases:
Formats the gnode table.
gnode -maj <major number>
Formats all gnodes with the given major number.
gnode -min <minor number>
Formats all gnodes with the given minor number.
gnode -fs <mount slot number>
Formats all gnodes for a given file system slot.
gnode -gno <gnode number>
Formats all gnodes with the given gnode number.
gnode -uid <user id>
Formats all gnodes owned by the given uid.
gnode -gid <group id>
Formats all gnodes owned by the given gid.
gnode -lmod <file permissions>
Formats all gnodes with the given protection. The command gnode -lmod 777 finds all gnodes that allow read/write/execute permission
to every one.
gnode -hmod <file type>
Formats all gnodes with the given file type. gnode -hmod 2 find all gnodes that are character special files.
gnode -amod <file modesfR>
Formats all gnodes that match the given modes exactly. The command gnode -amod 20777 finds all gnodes for character devices that
allow read/write/execute permission to every one.
gnode -all
Displays a more extensive list of the gnodes contents.
gnode -lock
Shows the SMP lock contained in the gnode.
gfree Prints the list of all inactive gnodes.
block [ - ] [ gnode table entries ] [ *gnode address ]
Prints the gnode data block addresses.
rnode [ gnode table entries ] [ *gnode address ]
Alias:
Prints the associated rnode values for gnodes that are remote (via NFS).
file [ file table entries ] [ *file address ]
Alias:
Formats the file table.
cred address
Prints the credentials at the given address.
crred address
Verifies the references of a credential at the given address.
crcheck
Verifies all references to all credentials.
mount [ -s ] [ mount table entries ] [ *mount address ]
Aliases:
Formats the mount table. The option gives a abbreviated format.
fsdata [ mount table entries ] [ *mount address ]
Alias:
Prints the fsdata structure associated with a mount entry.
mntinfo [ mount table entries ] [ *mount address ]
Alias:
Prints the mntinfo data structure associate with an NFS file system.
buf [ - ] [ buffer headers ] [ *buffer header address ]
Aliases:
Formats the system buffer headers. By using the - option, all buffer headers (including ones marked invalid) are printed.
bufgp [ gnode slots ] [ *gnode address ]
Alias:
Prints the buffer headers associated with the given gnode.
buflock
Prints the buffer headers on the locked list.
buflru Prints the buffer headers on the lru list.
bufage Prints the buffer headers on the aged list.
bufempty
Prints the buffer headers on the empty list.
buffer [ format ] [ list of buffers ]
Alias:
Prints the data in a system buffer according to format. If format is omitted, the previous format is used. Valid formats include
and The last creates a file in the current directory (see the Files section) containing the buffer data.
text [ text table entries ] [ *text address ]
Aliases:
Formats the text table.
ftext Alias:
Prints the list of free texts.
callout
Aliases:
Prints all entries in the callout table.
arp [ - ] [ address ]
Prints the arp table. The - option prints the entire table.
socket [ file slot ] [ *file address ]
Prints the socket structure associated with the given file slot.
tty [ - ] [ process slot ] [ *proc address ] [ #pid ]
Alias:
Prints the terminal structure attached to a process. The - option allows for the raw, cannonical, and output clists.
tty -clist
Includes clists in display of the tty struct.
tty -addr address
Prints the contents of a tty structure at the specified address.
map [ map names ]
Formats the named system map structures.
nm [ symbols ]
Prints the symbol value and type as found in the namelist file.
ts [ text addresses ]
Finds the closest text symbols to the given addresses.
ds [ data addresses ]
Finds the closest data symbols to the given addresses.
od [ symbol name or address ] [ count ] [ format ]
Aliases:
Dumps count data values starting at the symbol value or address given according to format. Allowable formats are or
dis address [ address ]
Disassembles starting at the first address and continuing until the second address. These addresses may be symbolic (that is,
syscall+33).
stat Prints useful statistics pertaining to the buffer cache, dnlc, namei translation cache, and others.
dupreq Displays the contents of the duplicate request cache. This is useful in finding out the recent history of NFS requests made to the
server.
mbuf address
Displays the chain starting at the given address.
inpcb -udp -tcp
Displays the chain of the corresponding protocol, or both TCP and UDP if no protocol is specified.
client Displays the client table, which contains client handles used to initiate rpc requests.
sync Resynchronizes the proc, mount, gnode, buffer, file and other internal tables up to the current state of This command is useful for
looking at changing values in runing kernels. However, you should not use it when looking at files.
svcxprt address
Prints the svcxprt structure located at address.
scs Traverses data structures in the System Communications Services (SCS) tree and displays the contents of the data structures.
scs -cb address
Displays the contents of an SCS connection block data structure at the specified address.
scs -cib address
Displays the contents of an SCS connection information block data structure at the specified address.
scs -pb address
Displays the contents of an SCS path block data structure at the specified address.
scs -pib address
Displays the contents of an SCS path information block data structure at the specified address.
scs -sb address
Displays the contents of an SCS system block data structure at the specified address.
scs -sib address
Displays the contents of an SCS system information block data structure at the specified address.
scsi Prints SCSI controller information.
scsi -target
Prints SCSI target information.
scsi -devtab
Prints SCSI devtab information.
scsi -trans
Prints SCSI transfer information.
scsi -cmd
Prints SCSI message or command data.
scsi -bbr
Prints SCSI Bad Block Replacement data.
scsi -error
Prints SCSI error information.
scsi -sii
Prints SCSI SII information.
scsi -dct
Prints SCSI DCT statistics.
scsi -spin
Prints SCSI SPIN statistics.
scsi -all
Prints all SCSIBUS information.
lock [-all] address
Prints the SMP lock structure located at address. The all flag displays all global SMP locks.
mscp Traverses both the mscp disk and tape subsystems, and prints the data structures for class blocks, connection blocks, unit blocks,
and active request blocks.
mscp -disk
Traverses the mscp disk subsystem and prints the data structures for the mscp class block, mscp connection blocks, mscp unit blocks,
and active request blocks.
mscp -tape
Traverses the tmscp tape subsystem and prints the data structures for the tmscp class block, tmscp connection blocks, tmscp unit
blocks, and active request blocks.
mscp -config
Traverses both the mscp disk and tape subsystems, and display the system configuration. This is done by printing summary informa-
tion from the class, connection, and unit blocks.
mscp -connb address
Prints the contents of an mscp connection block at the specified address.
mscp -classb address
Prints the contents of an mscp class block at the specified address.
mscp -unitb address
Prints the contents of an mscp unitb block at the specified address.
mscp -reqb address
Prints the contents of an mscp request block at the specified address.
mscp -dtable
Displays all the elements of the mscp disk unit table. Unused elements of the array will be specified as NULL.
mscp -ttable
Displays all the elements of the tmscp tape unit table. Unused elements of the array will be specified as NULL.
! Escapes to the shell.
#[ history ]
Repeats the last command. If a number is given (that is, #5), that command number is re-executed.
#h Alias:
Shows the history list.
q Exits from
? Prints a synopsis of commands.
Aliases
There are built-in aliases for many of the formats as well as those listed for the commands. Some of them are:
byte b.
character char, c.
decimal dec, e.
directory direct, dir, d.
hexadecimal hexadec, hex, h, x.
gnode gno , g.
longdec ld, D.
longoct lo, O.
octal oct, o.
write w.
Restrictions
Many of the flags are abbreviated making them difficult to interpret. A source listing of the system header files would be helpful when
using the utility.
Examing the stack of the current process on a running system and procs running at the time of a crash does not work.
Files
Header files for table and structure info
Default system image file
Default namelist file
Files created containing buffer data
See Also
mount(8), nm(1), ps(1), sh(1), stty(1), pstat(8)
crash(8)