2

So I've been trying to debug a weird intermittent kernel crash for a server running Ubuntu-Server 16.04, which has had me stumped for ages, and so I installed and setup linux-crashdump following the Ubuntu wiki crash dump recipe.

After waiting for the issue to rear its head again, linux-crashdump has done its thing and generated a crash dump, but now I can't figure out how to make any use of it!

The Ubuntu guide provides two methods for viewing them, either using crash or apport-retrace, but neither of these methods works as described.

apport-retrace simply returns:

ERROR: report file does not contain the required fields

Meanwhile for crash, I've downloaded the appropriate image with debug info using apt-get install linux-image-$(uname -r)-dbgsym as recommended, before running the following command:

crash /usr/lib/debug/boot/vmlinux-4.4.0-93-generic /var/crash/linux-image-4.4.0-93-generic-201709131146.crash

However this results in an error of:

crash: linux-image-4.4.0-93-generic-201709131146.crash: not a supported file format

What is the correct way to view linux-crashdump dumps now? Am I missing steps that aren't in the guide?

Haravikk
  • 267
  • 4
  • 12

2 Answers2

1

So I figured it out; it seems that the actual meat of the crash dump isn't in the .crash file at all, but instead is inside a folder.

The relevant contents of my /var/crash folder therefore looks like this:

/var/crash/
    201709131146/
        dmesg.201709131146
        dump.201709131146
    linux-image-4.4.0-93-generic-201709131146.crash

So what I needed to run was:

crash /usr/lib/debug/boot/vmlinux-4.4.0-93-generic /var/crash/201709131146/dump.201709131146

This (eventually) gave me the a useful stack trace and other details about what went wrong.

Haravikk
  • 267
  • 4
  • 12
0

You need to use apport-unpack. Then gdb and backtrace. There are good examples online about how to use apport-unpack.

Tux_DEV_NULL
  • 1,083
  • 7
  • 11
  • I'm afraid I might need a bit more to go-on than that; I can use apport-unpack to expand the .crash file into separate files but that doesn't solve any of the problems of then loading them somehow so I can see what went wrong. All of the examples I've found so far are for debugging app crashes, not kernel crashes. – Haravikk Sep 13 '17 at 15:26
  • When you unpack there should be a file called CoreDump. Then run the linux crash utility. For example `crash /usr/lib/debug/boot/vmlinux-3.x.0-24 /var/crash/CoreDump`. – Tux_DEV_NULL Sep 14 '17 at 08:02