Sidebar: Invoking crash

To run crash you will either have to have a group id of sys or user id of root, depending on your system. Group sys is needed to read /dev/mem and root permission will be needed on some systems to read nonvolatile RAM.

Command-Line Options

Most of the time you'll invoke crash without any arguments. Sometimes, though, you will want to use the following parameters:

-d (dumpfile) -- Defaults to /dev/mem. Specify this if you want to examine the mainstore dump from a crashed system.

-n (namelist) -- Defaults to /unix. Specify this if you are examining a mainstore dump, the kernel has been rebuilt, and you need to use a copy of the old kernel to view the dump.

-w (outputfile) -- Use this if you would like to save the output of crash to a file. You will not see output on the screen.

crash Command Syntax

Once you enter crash you see the ">" prompt. You can then enter commands and view the output. Commands may have a variety of options. Here are some of the common ones:

-f -- Gives you a full display of the table you request. Often this will give you obscure extra information, but some useful facts can be gleaned from the long displays.

-e -- Lists every entry in the table.

-w filename -- Redirects output to filename. You will not see the output on the screen.

Often crash commands will produce more output than you want to view. You can use ! to pipe output to shell commands such as grep or pg to facilitate table examination. For example, to look at the full process table you can type

proc ! pg

to page through the process table. To look at all getty processes type

proc ! grep getty

The -w crash command option will be ignored if you use the exclamation pipe.