System Administration Guide
Appendix D, Using the crash(ADM) diagnostic tool

Running the crash command

Running the crash command

To run crash to examine a live system, log in as root and enter the command:

/etc/crash

crash reads the kernel program file for symbol table information. It obtains the system memory image by opening the special device file /dev/mem. If the currently booted kernel is not /unix (symbolically linked to /stand/unix), you must specify the pathname of the kernel program file using the -n option. For example, if the kernel running at the time of the crash was /stand/unix.old, you would enter:

/etc/crash -n /stand/unix.old

To examine a memory image that you have saved to a file using ldsysdump(ADM), you must specify the name of this file using the -d option. For example, if you have used ldsysdump to save the memory image to the file /tmp/dumpfile, you would enter:

/etc/crash -d /tmp/dumpfile

Again, if the currently executing kernel is not the same as that running when the system crashed, you must specify the name of the correct kernel program file to crash using the -n option. For example, if you renamed the program file for the kernel that crashed as /stand/unix.crashed, enter:

/etc/crash -d /tmp/dumpfile -n /stand/unix.crashed

See ``Examples of using crash'' for typical instances in which you might use crash.