System Administration Guide
Appendix D, Using the crash(ADM) diagnostic tool

panic command

panic command

In this example, we assume that the memory image exists on the swap device. The following command invokes crash specifying that it is to read the memory image from /dev/swap, and use the symbol table in /stand/unix.test:

crash -d /dev/swap -n /stand/unix.test

  1. Use the panic command to discover the kernel trap type, the name of the routine and the address of the instruction that caused the panic:
    > panic
    System Messages:
    ERR=0, TRAPNO=0
    cs:eip=0158:f0055862 Flags=10286 ... eax= 00000001 ebx= f11100c0 ecx= 00000000 edx= f0055ac2 ... Kernel Stack before Trap:
    e0000b94 e0000bc8 panioctl (0xfacd0864,0x1,0,0x1) ...
    Trap number 0 shows that the panic was caused by a divide error. (See the trap(M) manual page for a list of possible CPU exceptions.)

    The first entry in the dump of the kernel stack shows the current stack frame when the panic occurred. This shows that the trap occurred within the routine panioctl.

  2. Use the dis command to examine the kernel code at the address given by the value of the instruction pointer (eip=0xf0055862):
    > dis 0xf0055862
    panioctl+0xa5     idivl  %ecx,%eax
    This instruction performs an integer long division of the contents of register EAX by the contents of ECX. The contents of these registers shown in the output from panic are 1 and 0 respectively. We can conclude that the panic was caused by the attempt to divide by zero.

Note that this is a fictitious example; there is no such routine as panioctl in the kernel.