[Crash-utility] Using crash - is a debug kernel required during vmcore collection

[Dave Anderson]

----- "Gallus" <gall.cwpl at gmail.com> wrote:

> I have a simple question: In order to use crash, the vmcore doesn't
> have to be collected under "debug" kernel? The symbols can be provided
> later, during the analysis with the crash tool, right?

I not sure I understand your question.  Are you asking that
if the vmcore of a particular kernel was collected, and you
you do not have the debuginfo vmlinux that is associated
with it, can you still analyze the vmcore?

If that's what you're asking, then yes, there are ways to do that.
You can rebuild the same kernel, and use the newly-built debuginfo
vmlinux file along with the System.map file of the original kernel,
like this:

  $ crash vmlinux-built-after-the-fact System-map vmcore

You will have a few restrictions -- such as not being able
to get line-number information from commands that display it.

This is the *only* reason a System.map file is *ever* needed,
and that's because the symbol values of the rebuilt debuginfo
vmlinux file typically do not match those of the original
crashing kernel.

If you're asking whether the secondary kdump kernel needs to
be the same as the crashing kernel, then the answer is no.

Dave