----- Original Message ----- > Hi, > I am using KDUMP tools( version: 2.0.4 ) to capture kernel panic information. > I configured the kernel compile para according to the kdump-tutorial, and > get dump file in /var/crash/ through echo c > /proc/sysrq-trigger . but when > I analyze the dump file using command: crash -d8 vmlinux dumpfile > error happens as following: > crash: seek error: kernel virtual address: c1625ccc type: "cpu_possible_mask" > The more log can be seen in the attachment: crash.log > > Otherwise, I found the size of dump file(dump-incomplete) is about 25M, but > my memory is 4G. why the dump file is so small? > My linux version is linux Mint15, basing on Ubuntu, the kernel version is > 3.8.13 . > > v10@COS-Desktop ~ $ > v10@COS-Desktop ~ $ cat /proc/cmdline > BOOT_IMAGE=/boot/vmlinuz-3.8.13.13-cos-i686 > root=UUID=c0bd0f62-0dfa-4425-8afa-b5ff8a00df5c ro > crashkernel=384M-2G:64M,2G-:128M quiet splash > v10@COS-Desktop ~ $ > v10@COS-Desktop ~ $ cat /var/crash/kexec_cmd > /sbin/kexec -p --command-line="BOOT_IMAGE=/boot/vmlinuz-3.8.13.13-cos-i686 > root=UUID=c0bd0f62-0dfa-4425-8afa-b5ff8a00df5c ro quiet splash irqpoll > maxcpus=1 nousb " --initrd=/boot/initrd.img-3.8.13.13-cos-i686 > /boot/vmlinuz-3.8.13.13-cos-i686 > v10@COS-Desktop ~ $ > v10@COS-Desktop ~ $ > > other log: > v10@COS-Desktop ~ $ sudo crash --minimal kdump/0211/vmlinux /var/crash/201402120848/dump-incomplete I am not familiar with Ubuntu's handling of the kexec-tools package, but presumably when the kdump procedure starts, it opens the dumpfile with the name "dump-incomplete". And after the procedure completes successfully, it would change the dumpfile name to "vmcore". Since the dumpfile remained named as "dump-incomplete", the kdump procedure apparently failed. > [sudo] password for v10: > > crash 6.1.6 > Copyright (C) 2002-2013 Red Hat, Inc. > Copyright (C) 2004, 2005, 2006, 2010 IBM Corporation > Copyright (C) 1999-2006 Hewlett-Packard Co > Copyright (C) 2005, 2006, 2011, 2012 Fujitsu Limited > Copyright (C) 2006, 2007 VA Linux Systems Japan K.K. > Copyright (C) 2005, 2011 NEC Corporation > Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc. > Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc. > This program is free software, covered by the GNU General Public License, > and you are welcome to change it and/or distribute copies of it under > certain conditions. Enter "help copying" to see the conditions. > This program has absolutely no warranty. Enter "help warranty" for details. > > GNU gdb (GDB) 7.3.1 > Copyright (C) 2011 Free Software Foundation, Inc. > License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> > This is free software: you are free to change and redistribute it. > There is NO WARRANTY, to the extent permitted by law. Type "show copying" > and "show warranty" for details. > This GDB was configured as "i686-pc-linux-gnu"... > > NOTE: minimal mode commands: log, dis, rd, sym, eval, set, extend and exit > > crash> > crash> > crash> rd linux_banner 30 > rd: seek error: kernel virtual address: c1622080 type: "32-bit KVADDR" > crash> > crash> > crash> A "seek error" simply means that the physical memory page was not found in the (incomplete) dumpfile. But this is not a crash utility issue, but rather a problem with your system's handling of the the kdump procedure. A dump of the secondary kernel's output (if available) may shed some light on what the problem was. Dave Anderson -- Crash-utility mailing list Crash-utility@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/crash-utility