----- "Gallus" <gall.cwpl@xxxxxxxxx> wrote: > I have a simple question: In order to use crash, the vmcore doesn't > have to be collected under "debug" kernel? The symbols can be provided > later, during the analysis with the crash tool, right? I not sure I understand your question. Are you asking that if the vmcore of a particular kernel was collected, and you you do not have the debuginfo vmlinux that is associated with it, can you still analyze the vmcore? If that's what you're asking, then yes, there are ways to do that. You can rebuild the same kernel, and use the newly-built debuginfo vmlinux file along with the System.map file of the original kernel, like this: $ crash vmlinux-built-after-the-fact System-map vmcore You will have a few restrictions -- such as not being able to get line-number information from commands that display it. This is the *only* reason a System.map file is *ever* needed, and that's because the symbol values of the rebuilt debuginfo vmlinux file typically do not match those of the original crashing kernel. If you're asking whether the secondary kdump kernel needs to be the same as the crashing kernel, then the answer is no. Dave -- Crash-utility mailing list Crash-utility@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/crash-utility
