|
@@ -47,19 +47,12 @@ parameter. Optionally the size of the ELF header can also be passed
|
|
|
when using the elfcorehdr=[size[KMG]@]offset[KMG] syntax.
|
|
|
|
|
|
|
|
|
-With the dump-capture kernel, you can access the memory image, or "old
|
|
|
-memory," in two ways:
|
|
|
-
|
|
|
-- Through a /dev/oldmem device interface. A capture utility can read the
|
|
|
- device file and write out the memory in raw format. This is a raw dump
|
|
|
- of memory. Analysis and capture tools must be intelligent enough to
|
|
|
- determine where to look for the right information.
|
|
|
-
|
|
|
-- Through /proc/vmcore. This exports the dump as an ELF-format file that
|
|
|
- you can write out using file copy commands such as cp or scp. Further,
|
|
|
- you can use analysis tools such as the GNU Debugger (GDB) and the Crash
|
|
|
- tool to debug the dump file. This method ensures that the dump pages are
|
|
|
- correctly ordered.
|
|
|
+With the dump-capture kernel, you can access the memory image through
|
|
|
+/proc/vmcore. This exports the dump as an ELF-format file that you can
|
|
|
+write out using file copy commands such as cp or scp. Further, you can
|
|
|
+use analysis tools such as the GNU Debugger (GDB) and the Crash tool to
|
|
|
+debug the dump file. This method ensures that the dump pages are correctly
|
|
|
+ordered.
|
|
|
|
|
|
|
|
|
Setup and Installation
|
|
@@ -423,18 +416,6 @@ the following command:
|
|
|
|
|
|
cp /proc/vmcore <dump-file>
|
|
|
|
|
|
-You can also access dumped memory as a /dev/oldmem device for a linear
|
|
|
-and raw view. To create the device, use the following command:
|
|
|
-
|
|
|
- mknod /dev/oldmem c 1 12
|
|
|
-
|
|
|
-Use the dd command with suitable options for count, bs, and skip to
|
|
|
-access specific portions of the dump.
|
|
|
-
|
|
|
-To see the entire memory, use the following command:
|
|
|
-
|
|
|
- dd if=/dev/oldmem of=oldmem.001
|
|
|
-
|
|
|
|
|
|
Analysis
|
|
|
========
|