kk Blog —— 通用基础


date [-d @int|str] [+%s|"+%F %T"]
netstat -ltunp
sar -n DEV 1

makedumpfile.8

makedumpfile.8

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
NAME

       makedumpfile - make a small dumpfile of kdump

SYNOPSIS

       makedumpfile    [OPTION] [-x VMLINUX|-i VMCOREINFO] VMCORE DUMPFILE
       makedumpfile -F [OPTION] [-x VMLINUX|-i VMCOREINFO] VMCORE
       makedumpfile -R DUMPFILE
       makedumpfile   --split   [OPTION]  [-x  VMLINUX|-i  VMCOREINFO]  VMCORE
       DUMPFILE1 DUMPFILE2 [DUMPFILE3 ..]
       makedumpfile --reassemble DUMPFILE1 DUMPFILE2 [DUMPFILE3 ..] DUMPFILE
       makedumpfile -g VMCOREINFO -x VMLINUX
       makedumpfile  -E  [--xen-syms   XEN-SYMS|--xen-vmcoreinfo   VMCOREINFO]
       VMCORE DUMPFILE
       makedumpfile --dump-dmesg [-x VMLINUX|-i VMCOREINFO] VMCORE LOGFILE
       makedumpfile -h
       makedumpfile -v

DESCRIPTION

       With  kdump,  the  memory  image  of the first kernel (called "panicked
       kernel") can be taken as /proc/vmcore while the second  kernel  (called
       "kdump   kernel"   or  "capture  kernel")  is  running.  This  document
       represents /proc/vmcore as VMCORE. makedumpfile makes a small  DUMPFILE
       by  compressing  dump  data  or  by  excluding  unnecessary  pages  for
       analysis,  or  both.  makedumpfile  needs  the  first  kernel's   debug
       information,  so that it can distinguish unnecessary pages by analyzing
       how the first kernel uses the memory.  The  information  can  be  taken
       from VMLINUX or VMCOREINFO.

       makedumpfile  can  exclude  the  following types of pages while copying
       VMCORE to DUMPFILE, and a user can choose which type of pages  will  be
       excluded.
       - Pages filled with zero
       - Cache pages
       - User process data pages
       - Free pages

       makedumpfile  provides  two  DUMPFILE  formats  (the ELF format and the
       kdump-compressed format). By default, makedumpfile makes a DUMPFILE  in
       the  kdump-compressed  format.  The kdump-compressed format is readable
       only with the crash utility, and it can be smaller than the ELF  format
       because of the compression support. The ELF format is readable with GDB
       and the crash utility.  If a user wants to use GDB, DUMPFILE format has
       to be explicitly specified to be the ELF format.

       To  analyze  the first kernel's memory usage, makedumpfile can refer to
       VMCOREINFO instead of VMLINUX. VMCOREINFO contains the  first  kernel's
       information  (structure  size,  field  offset, etc.), and VMCOREINFO is
       small enough to be included into the second kernel's initrd.
       If the second kernel is running on its initrd without mounting  a  root
       file  system,  makedumpfile  cannot refer to VMLINUX because the second
       kernel's initrd cannot include a large file like VMLINUX. To solve  the
       problem,  makedumpfile  makes  VMCOREINFO  beforehand, and it refers to
       VMCOREINFO instead of VMLINUX while the second kernel is running.
       VMCORE has contained VMCOREINFO since linux-2.6.24, and a user does not
       need to specify neither -x nor -i option.

       If the second kernel is running on its initrd without mounting any file
       system, a user needs to transport the dump data to a  remote  host.  To
       transport  the  dump data by SSH, makedumpfile outputs the dump data in
       the intermediate format (the flattened format) to the standard  output.
       By piping the output data to SSH, a user can transport the dump data to
       a remote host. Note that  analysis  tools  cannot  read  the  flattened
       format directly, so on a remote host the received data in the flattened
       format needs  to  be  rearranged  to  a  readable  DUMPFILE  format  by
       makedumpfile (or makedumpfile-R.pl).

       makedumpfile can read a DUMPFILE in the kdump-compressed format instead
       of VMCORE and re-filter it. This feature is useful  in  situation  that
       users need to reduce the file size of DUMPFILE for sending it somewhere
       by ftp/scp/etc. (If all of the page types, which are specified by a new
       dump_level,  are  excluded  from  an  original  DUMPFILE already, a new
       DUMPFILE is the same as an original DUMPFILE.)
       For example, makedumpfile can create a DUMPFILE of dump_level  31  from
       the one of dump_level 3 like the following:
       Example:
       # makedumpfile -c -d 3 /proc/vmcore dumpfile.1
       # makedumpfile -c -d 31 dumpfile.1 dumpfile.2

OPTIONS

       -c     Compress dump data by each page.
              A  user  cannot  specify this option with -E option, because the
              ELF format does not support compressed data.
              Example:
              # makedumpfile -c -d 31 -x vmlinux /proc/vmcore dumpfile

       -d dump_level
              Specify the type of unnecessary page for analysis.
              Pages of the specified type are not copied to DUMPFILE. The page
              type  marked  in  the  following  table  is excluded. A user can
              specify multiple page types by setting the sum of each page type
              for  dump_level.  The  maximum  of dump_level is 31. Note that a
              dump_level for Xen dump filtering is 0 or 1 on a  machine  other
              than  x86_64  (On an x86_64 machine, it is possible to specify 2
              or bigger as a dump_level).
              If specifying  multiple  dump_levels  with  the  delimiter  ',',
              makedumpfile  retries  to  create a DUMPFILE by other dump_level
              when "No  space  on  device"  error  happens.  For  example,  if
              dump_level  is  "11,31" and makedumpfile fails by dump_level 11,
              makedumpfile retries it by dump_level 31.
              Example:
              # makedumpfile -d 11 -x vmlinux /proc/vmcore dumpfile
              # makedumpfile -d 11,31 -x vmlinux /proc/vmcore dumpfile

                dump | zero | cache|cache  | user | free
               level | page | page |private| data | page
              -------+------+------+-------+------+------
                   0 |      |      |       |      |
                   1 |  X   |      |       |      |
                   2 |      |  X   |       |      |
                   3 |  X   |  X   |       |      |
                   4 |      |  X   |  X    |      |
                   5 |  X   |  X   |  X    |      |
                   6 |      |  X   |  X    |      |
                   7 |  X   |  X   |  X    |      |
                   8 |      |      |       |  X   |
                   9 |  X   |      |       |  X   |
                  10 |      |  X   |       |  X   |
                  11 |  X   |  X   |       |  X   |
                  12 |      |  X   |  X    |  X   |
                  13 |  X   |  X   |  X    |  X   |
                  14 |      |  X   |  X    |  X   |
                  15 |  X   |  X   |  X    |  X   |
                  16 |      |      |       |      |  X
                  17 |  X   |      |       |      |  X
                  18 |      |  X   |       |      |  X
                  19 |  X   |  X   |       |      |  X
                  20 |      |  X   |  X    |      |  X
                  21 |  X   |  X   |  X    |      |  X
                  22 |      |  X   |  X    |      |  X
                  23 |  X   |  X   |  X    |      |  X
                  24 |      |      |       |  X   |  X
                  25 |  X   |      |       |  X   |  X
                  26 |      |  X   |       |  X   |  X
                  27 |  X   |  X   |       |  X   |  X
                  28 |      |  X   |  X    |  X   |  X
                  29 |  X   |  X   |  X    |  X   |  X
                  30 |      |  X   |  X    |  X   |  X
                  31 |  X   |  X   |  X    |  X   |  X

       -E     Create DUMPFILE in the ELF format.
              This option cannot be specified with -c option, because the  ELF
              format does not support compressed data.
              Example:
              # makedumpfile -E -d 31 -x vmlinux /proc/vmcore dumpfile

       -f     Force existing DUMPFILE to be overwritten.
              Example:
              # makedumpfile -f -d 31 -x vmlinux /proc/vmcore dumpfile
              This command overwrites DUMPFILE even if it already exists.

       -x VMLINUX
              Specify  the  first  kernel's  VMLINUX with debug information to
              analyze the first kernel's memory usage.
              This option is necessary if VMCORE does not contain  VMCOREINFO,
              [-i VMCOREINFO] is not specified, and dump_level is 2 or more.
              The  page  size of the first kernel and the second kernel should
              match.
              Example:
              # makedumpfile -d 31 -x vmlinux /proc/vmcore dumpfile

       -i VMCOREINFO
              Specify VMCOREINFO instead of VMLINUX for  analyzing  the  first
              kernel's memory usage.
              VMCOREINFO  should  be  made  beforehand by makedumpfile with -g
              option, and it contains the first kernel's information.
              This option is necessary if VMCORE does not contain  VMCOREINFO,
              [-x VMLINUX] is not specified, and dump_level is 2 or more.
              Example:
              # makedumpfile -d 31 -i vmcoreinfo /proc/vmcore dumpfile

       -g VMCOREINFO
              Generate  VMCOREINFO  from the first kernel's VMLINUX with debug
              information.
              VMCOREINFO must be generated on the system that is  running  the
              first  kernel.  With  -i  option,  a user can specify VMCOREINFO
              generated on the other system that is  running  the  same  first
              kernel. [-x VMLINUX] must be specified.
              Example:
              # makedumpfile -g vmcoreinfo -x vmlinux

       -F     Output  the  dump  data  in the flattened format to the standard
              output for transporting the dump data by SSH.
              Analysis tools cannot read the flattened  format  directly.  For
              analysis,  the  dump  data  in  the  flattened  format should be
              rearranged to a normal DUMPFILE (readable with  analysis  tools)
              by  -R  option. By which option is specified with -F option, the
              format of the rearranged DUMPFILE is fixed.  In other words,  it
              is  impossible to specify the DUMPFILE format when the dump data
              is rearranged with -R option. If specifying -E  option  with  -F
              option, the format of the rearranged DUMPFILE is the ELF format.
              Otherwise, it is the kdump-compressed format. All  the  messages
              are  output  to  standard  error  output  by  -F  option because
              standard output is used for the dump data.
              Example:
              # makedumpfile -F -c -d 31 -x vmlinux /proc/vmcore \
              | ssh user@host "cat > dumpfile.tmp"
              # makedumpfile -F -c -d 31 -x vmlinux /proc/vmcore \
              | ssh user@host "makedumpfile -R dumpfile"
              # makedumpfile -F -E -d 31 -i vmcoreinfo  /proc/vmcore \
              | ssh user@host "makedumpfile -R dumpfile"
              # makedumpfile -F -E --xen-vmcoreinfo VMCOREINFO /proc/vmcore \
              | ssh user@host "makedumpfile -R dumpfile"

       -R     Rearrange the  dump  data  in  the  flattened  format  from  the
              standard  input  to  a  normal  DUMPFILE (readable with analysis
              tools).
              Example:
              # makedumpfile -R dumpfile < dumpfile.tmp
              # makedumpfile -F -d 31 -x vmlinux /proc/vmcore \
              | ssh user@host "makedumpfile -R dumpfile"

              Instead of using -R option, a  perl  script  "makedumpfile-R.pl"
              rearranges  the  dump  data  in the flattened format to a normal
              DUMPFILE, too. The perl script does not depend on  architecture,
              and  most systems have perl command.  Even if a remote host does
              not have makedumpfile, it is possible to rearrange the dump data
              in  the flattened format to a readable DUMPFILE on a remote host
              by running this script.
              Example:
              # makedumpfile -F -d 31 -x vmlinux /proc/vmcore \
              | ssh user@host "makedumpfile-R.pl dumpfile"

       --split
              Split the dump  data  to  multiple  DUMPFILEs  in  parallel.  If
              specifying  DUMPFILEs on different storage devices, a device can
              share I/O load with other devices and it reduces time for saving
              the  dump  data.  The file size of each DUMPFILE is smaller than
              the system memory  size  which  is  divided  by  the  number  of
              DUMPFILEs.  This  feature  supports  only  the  kdump-compressed
              format.
              Example:
              # makedumpfile --split -d 31 -x vmlinux  /proc/vmcore  dumpfile1
              dumpfile2

       --reassemble
              Reassemble  multiple  DUMPFILEs,  which  are  created by --split
              option,  into  one  DUMPFILE.  dumpfile1   and   dumpfile2   are
              reassembled into dumpfile on the following example.
              Example:
              # makedumpfile --reassemble dumpfile1 dumpfile2 dumpfile

       --xen-syms XEN-SYMS
              Specify the XEN-SYMS with debug information to analyze the xen's
              memory  usage.   This  option  extracts  the  part  of  xen  and
              domain-0.  -E option must be specified with this option.
              Example:
              # makedumpfile -E --xen-syms xen-syms /proc/vmcore dumpfile

       --xen-vmcoreinfo VMCOREINFO
              Specify  VMCOREINFO  instead of XEN-SYMS for analyzing the xen's
              memory usage.
              VMCOREINFO should be made beforehand  by  makedumpfile  with  -g
              option,  and  it contains the xen's information.  -E option must
              be specified with this option.
              Example:
              #  makedumpfile  -E  --xen-vmcoreinfo  VMCOREINFO   /proc/vmcore
              dumpfile

       -X     Exclude  all  the user domain pages from Xen kdump's VMCORE, and
              extracts the part  of  xen  and  domain-0.  If  VMCORE  contains
              VMCOREINFO  for  Xen,  it is not necessary to specify --xen-syms
              and --xen-vmcoreinfo.  -E option must  be  specified  with  this
              option.
              Example:
              # makedumpfile -E -X /proc/vmcore dumpfile

       --xen_phys_start xen_phys_start_address
              This    option    is    only    for    x86_64.     Specify   the
              xen_phys_start_address, if the xen code/data is relocatable  and
              VMCORE does not contain xen_phys_start_address in the CRASHINFO.
              xen_phys_start_address can be taken from the line of "Hypervisor
              code  and  data" in /proc/iomem. For example, specify 0xcee00000
              as xen_phys_start_address if /proc/iomem is the following:
                -------------------------------------------------------
                # cat /proc/iomem
                ...
                  cee00000-cfd99999 : Hypervisor code and data
                ...
                -------------------------------------------------------

              Example:
              # makedumpfile -E -X  --xen_phys_start  0xcee00000  /proc/vmcore
              dumpfile

       --message-level message_level
              Specify the message types.
              Users  can  restrict outputs printed by specifying message_level
              with this option. The message type  marked  with  an  X  in  the
              following table is printed. For example, according to the table,
              specifying 7 as message_level means progress  indicator,  common
              message,  and  error  message are printed, and this is a default
              value. Note that the maximum value of message_level is 31.

               message | progress | common  | error   | debug   | report
               level   | indicator| message | message | message | message
              ---------+----------+---------+---------+---------+---------
                     0 |          |         |         |         |
                     1 |    X     |         |         |         |
                     2 |          |    X    |         |         |
                     3 |    X     |    X    |         |         |
                     4 |          |         |    X    |         |
                     5 |    X     |         |    X    |         |
                     6 |          |    X    |    X    |         |
                   * 7 |    X     |    X    |    X    |         |
                     8 |          |         |         |    X    |
                     9 |    X     |         |         |    X    |
                    10 |          |    X    |         |    X    |
                    11 |    X     |    X    |         |    X    |
                    12 |          |         |    X    |    X    |
                    13 |    X     |         |    X    |    X    |
                    14 |          |    X    |    X    |    X    |
                    15 |    X     |    X    |    X    |    X    |
                    16 |          |         |         |         |    X
                    17 |    X     |         |         |         |    X
                    18 |          |    X    |         |         |    X
                    19 |    X     |    X    |         |         |    X
                    20 |          |         |    X    |         |    X
                    21 |    X     |         |    X    |         |    X
                    22 |          |    X    |    X    |         |    X
                    23 |    X     |    X    |    X    |         |    X
                    24 |          |         |         |    X    |    X
                    25 |    X     |         |         |    X    |    X
                    26 |          |    X    |         |    X    |    X
                    27 |    X     |    X    |         |    X    |    X
                    28 |          |         |    X    |    X    |    X
                    29 |    X     |         |    X    |    X    |    X
                    30 |          |    X    |    X    |    X    |    X
                    31 |    X     |    X    |    X    |    X    |    X

       --vtop virtual_address
              This option is useful, when user debugs the translation  problem
              of  virtual  address. If specifing virtual_address, its physical
              address is printed. It makes debugging  easy  by  comparing  the
              output  of  this option with the one of "vtop" subcommand of the
              crash utility.  "--vtop"  option  only  prints  the  translation
              output, and it does not affect the dumpfile creation.

       --dump-dmesg
              This  option  overrides  the  normal  behavior  of makedumpfile.
              Instead of  compressing  and  filtering  a  VMCORE  to  make  it
              smaller,  it  simply  extracts  the  dmesg log from a VMCORE and
              writes it to the specified LOGFILE. If a VMCORE does not contain
              VMCOREINFO for dmesg, it is necessary to specfiy [-x VMLINUX] or
              [-i VMCOREINFO].

              Example:
              # makedumpfile --dump-dmesg /proc/vmcore dmesgfile
              # makedumpfile --dump-dmesg -x vmlinux /proc/vmcore dmesgfile

       -D     Print debugging message.

       -h     Show help message.

       -v     Show the version of makedumpfile.

ENVIRONMENT VARIABLES

       TMPDIR  This environment variable is  for  a  temporary  memory  bitmap
               file.   If  your machine has a lots of memory and you use tmpfs
               on /tmp, makedumpfile can fail for a little memory in  the  2nd
               kernel because makedumpfile makes a very large temporary memory
               bitmap file in this case. To avoid this failure, you can set  a
               TMPDIR  environment  variable.  If  you  do  not  set  a TMPDIR
               environment variable, makedumpfile uses /tmp  directory  for  a
               temporary bitmap file as a default.

DIAGNOSTICS

       makedumpfile exits with the following value.

       0 : makedumpfile succeeded.

       1 : makedumpfile failed without the following reasons.

       2  :  makedumpfile failed due to the different version between  VMLINUX
       and VMCORE.

       3 : makedumpfile failed due to the analysis error of the memory.

AUTHORS

       Written by Masaki Tachibana, and Ken'ichi Ohmichi.

precise (8) makedumpfile.8.gz

Provided by: makedumpfile_1.3.7-2_i386

debug, kdump、crash

« linux内核网络分层结构 暴力密码破解工具--关键在于字典 »