Dave Anderson <anderson@xxxxxxxxxx> writes: > Good question -- I'm not sure. > > If the buffer were "cleared" by the administrator, the logical "end" of > the buffer would not be the last thing displayed by the "log" command. > But that's really not a problem, given that the relevant kernel-crash-related > data is still available to be examined. > > On the other hand, even though the administrator has "cleared" the log > buffer, the data is still there. My concern would be what if there is > crucial data in the log buffer that the administrator "cleared" out of > convenience? Like for example, I've often done a "dmesg -c" to clear > the buffer so that subsequent dmesg commands just dump the latest > information. But then I've gone back with the crash utility and > re-examined the log buffer data that still remains in memory -- which > can be still be seen with the "log" command. > > So my initial leaning would be to continue to show what's actually there. > I trust myself as a crash analyzer more than I trust the administrator. > > But I could be convinced otherwise. > > What do others on the list think about this? I would much rather see all of the contents of the log buffer. Cheers, Jeff -- Crash-utility mailing list Crash-utility@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/crash-utility
