Sidebar: Learning about crash

crash is not well documented. To explain it fully would require descriptions of hundreds of kernel variables and most internal UNIX activities. Instead, crash documentation is limited to the man pages, which describe the crash commands without telling how to interpret the output. Nevertheless, you can browse the man pages and experiment with commands that look promising.

Another way to learn more about crash is to look up crash field titles in the header files in /usr/include/sys. As an example, one of the items in a full process display in crash is clktim. The comment for field p_clktim in proc.h reveals that this is the time until the next alarm will go off for the program.

Eventually, you will exhaust what you can figure out by these means and then you will have two choices. You can get further training on UNIX internals, or you can stop there, knowing that you have learned many useful commands.