[Crash-utility] About the use of 'gcore'

[Dave Anderson]

----- Original Message -----
> Hello all,
> 
> Now that we have dumped the kernel stack, I'm intesresting in the user
> process from which we came just before the 'panic'.
> Googling around, I found mention of the 'gcore' extension.
> 
> I compiled version 1.22 and installed it.
> Using it on crash 6.1.0-1.el6, I get a file core.845.bash on process 'bash'
> (in which I trigger a kernel panic) :
> 
> 
> 
> crash> gcore -v 1 845
> gcore: Opening file core.845.bash ...
> gcore: done.
> gcore: Writing ELF header ...
> gcore: done.
> gcore: Retrieving and writing note information ...
> gcore: done.
> gcore: Writing PT_NOTE program header ...
> gcore: done.
> gcore: Writing PT_LOAD program headers ...
> gcore: done.
> gcore: Writing PT_LOAD segment ...
> gcore: PT_LOAD[0]: 8048000 - 8048000
> gcore: PT_LOAD[1]: 80e2000 - 80e9000
> gcore: PT_LOAD[2]: 80e9000 - 80ed000
> gcore: PT_LOAD[3]: 94a2000 - 94d1000
> gcore: PT_LOAD[4]: b7374000 - b7374000
> gcore: PT_LOAD[5]: b7375000 - b7376000
> gcore: PT_LOAD[6]: b7376000 - b7377000
> gcore: PT_LOAD[7]: b7377000 - b7377000
> gcore: PT_LOAD[8]: b737e000 - b737e000
> gcore: PT_LOAD[9]: b737f000 - b737f000
> gcore: PT_LOAD[10]: b73bb000 - b73bb000
> gcore: PT_LOAD[11]: b75bb000 - b75bb000
> gcore: PT_LOAD[12]: b75c7000 - b75c8000
> gcore: PT_LOAD[13]: b75c8000 - b75c9000
> gcore: PT_LOAD[14]: b75c9000 - b75ca000
> gcore: PT_LOAD[15]: b75ca000 - b75ca000
> gcore: PT_LOAD[16]: b7756000 - b7758000
> gcore: PT_LOAD[17]: b7758000 - b7759000
> gcore: PT_LOAD[18]: b7759000 - b775c000
> gcore: PT_LOAD[19]: b775c000 - b775c000
> gcore: PT_LOAD[20]: b775f000 - b7760000
> gcore: PT_LOAD[21]: b7760000 - b7761000
> gcore: PT_LOAD[22]: b7761000 - b7761000
> gcore: PT_LOAD[23]: b7764000 - b7765000
> gcore: PT_LOAD[24]: b7769000 - b776a000
> gcore: PT_LOAD[25]: b776a000 - b776b000
> gcore: PT_LOAD[26]: b776b000 - b776b000
> gcore: PT_LOAD[27]: b7789000 - b778a000
> gcore: PT_LOAD[28]: b778a000 - b778b000
> gcore: PT_LOAD[29]: bfd07000 - bfd1d000
> gcore: done.
> Saved core.845.bash
> crash>
> 
> So far, so good... But
> 
> Question: Are there anywhere some hints about how to use this core.<pid> file
> ?
> 
> Thanks in advance.
> Regards,
> Patrick Agrain

It's meant to be used with gdb, similar to a normal core file generated if
the user-space process crashed and dropped a core file, or if it was created
by using the user-space /usr/bin/gcore command.  So try this:

 $ gdb /usr/bin/bash core.845.bash

Dave