[Crash-utility] question on some command params

[Dave Anderson]

Jun Koi wrote:
> On Tue, Sep 23, 2008 at 2:49 AM, Dave Anderson <anderson at redhat.com> wrote:
> 
>>Jun Koi wrote:
>>
>>>On Tue, Sep 23, 2008 at 12:49 AM, Dave Anderson <anderson at redhat.com>
>>>wrote:
>>>
>>>
>>>>Jun Koi wrote:
>>>>
>>>>
>>>>>Hi,
>>>>>
>>>>>I found below cmdline params having no documentation anywhere, so
>>>>>could somebody explain their meaning?
>>>>>
>>>>>- memory_module
>>>>>- no_modules
>>>>>- no_ikconfig
>>>>>- no_namelist_gzip
>>>>>- no_kmem_cache
>>>>>- kmem_cache_delay
>>>>>- readnow
>>>>>- buildinfo
>>>>>- zero_excluded
>>>>>
>>>>>
>>>>>Many thanks,
>>>>>J
>>>>
>>>>They're all essentially debug flags for use on kernels/dumpfiles
>>>>that for some reason or other would not initialize properly.
>>>>
>>>>memory_module: if /dev/mem or /dev/crash do not suffice you could
>>>>force-feed one or the other for live system analysys.
>>>
> 
> Sorry if this is a stupid question, but how to have /dev/crash device?
> 
> Thanks,
> J

If /dev/mem is restricted to the first 1MB, as is the case for Red Hat kernels,
then it's useless as the memory device for live system analysis.  So Red Hat
kernels offer a "misc"-type driver called crash.ko, which the crash utility
modprobes for, and if it shows up in /proc/misc, it then mknod's it as "/dev/crash",
and uses it for the memory device.

I honestly don't know if it's been ported to any non-Red Hat-based distros,
but if not, you're basically stuck using /dev/mem.  /dev/mem is fine for most
arches, but for 32-bit arches, it's restricted to lowmem (the first 896MB
of physical memory.  So you can end up with a limited crash session whenever
highmem physical memory is required for a given command.

Dave