Core dump analysis with crash

The crash utility can be used to perform some elementary core dump analysis.

Invoke crash on a crash dump with the command crash -d vmcore.# -n unix.#.

Use stat to obtain general information, including the program counter and the stack pointer, along with some error indications.

Use u to obtain information on the current process, including the process slot number.

proc lists out the process table. Match up process slot numbers to find the culprit in the case of a system crash. proc -l reports user credentials information, and proc -e reports all processes.

For system hangs, the kmastat option may provide useful clues regarding kernel memory useage. If it has been enabled (see the Kernel Memory Page), kmausers can provide detailed information regarding memory allocation inside each of the buckets.

defthread and defproc provide the current thread and process addresses. ? provides online help.