Accelerated Linux Core Dump Analysis/

...

/

Examine Normal Kernel Dumps

Examine Normal Kernel Dumps

Learn how to navigate a normal kernel dump.

We'll cover the following...

In this lesson, we will learn how to navigate through a normal kernel dump using crash.

Loading the core dump

We’ve manually crashed a normally running kernel to collect a dump for this exercise (by echoing c to sysreq-trigger, as described in the “Overview and Required Tools” lesson).

crash dump.202112280237 ../KSym/vmlinux-5.10.0-10-amd64

Note: The loading process of the core dump may take some time.

The above command will output the following to the terminal:

Identifying the current thread

We can see the current thread from the process ID that led to the crash with the following command:

bt

The above command will output the following to the terminal:

Note: User space addresses are not available in the kernel dump.

sym 00007f1ddc1f0f33
sym ffffffff9047f24d

The sym command interconverts between symbols and their virtual addresses.

Seeking help

The tool ...