crashutil - manipulate crash dump data
/usr/sbin/crashutil [-q] [-v version] source [destination]
crashutil copies and preserves crash dump data, and performs format
conversions on it. Common uses of crashutil include:
+ Copying portions of a dump that still reside on a raw dump device
into a crash dump directory.
+ Converting between different formats of crash dumps.
+ Copying crash dumps from one directory, or medium, to another.
crashutil will write to its destination the crash dump it reads from
its source. The crash dump format used to write the destination is
specified with -v; if -v is not specified, the destination will have
the same format as the source. If no destination is specified, source
is used; the format conversion will be done in place in the source,
without copying. When crashutil completes successfully, the entire
contents of the crash dump will exist at destination; any portions
that had still been on raw dump devices will have been copied to
There are three known dump formats:
COREFILE (Version 0) This format, used up through HP-UX 10.01,
consists of a single file containing the physical memory
image, with a 1-to-1 correspondence between file offset
and memory address. Normally there is an associated
file containing the kernel image. sources or
destinations of this type must be specified as two
pathnames to plain files, separated by whitespace; the
first is the core image file and the second is the
kernel image file.
COREDIR (Version 1) This format, used in HP-UX 10.10, 10.20, and
10.30, consists of a core.n directory containing an
INDEX file, the kernel (vmunix) file, and numerous
core.n.m files, which contain portions of the physical
memory image. sources or destinations of this type
should be specified as the pathname to a core directory.
CURRENT (Version 2 - the current version) This format, used in
HP-UX 11.00 and later, consists of a crash.n directory
containing an INDEX file, the kernel and all dynamically
loaded kernel module files, and numerous image.m.p
Hewlett-Packard Company - 1 - HP-UX Release 11i: November 2000
files, each of which contain portions of the physical
memory image and metadata describing which memory pages
were dumped and which were not. sources or destinations
of this type should be specified as the pathname to a
Other formats, for example tape archival formats, may be added in the
When the source and destination are different types of files - for
example, when source is a directory and destination is a pair of plain
files - both must be specified.
-q (Quiet) Disables the printing of progress messages.
Warning and error messages are still printed.
-v version Specifies the version of the destination format. Allowed
values are COREFILE, COREDIR, CRASHDIR, 0, 1, or 2. Also
allowed is the keyword CURRENT, which specifies that the
destination format should be the same as the current
source format. CURRENT is the default if -v is not
Upon exit, crashutil returns the following values:
0 The operation was successful.
1 The operation failed, and an appropriate error message was
An HP-UX 11.00 crash dump was saved by savecrash(1M) to
/var/adm/crash/crash.2. The -p flag was specified to savecrash,
specifying that only those portions of the dump which were endangered
by swap activity should be saved; the rest are still resident in the
raw dump devices. To save the remainder of the dump into the crash
dump directory, use:
If preferred, the completed crash dump directory could be in a
different location - perhaps on another machine via NFS:
crashutil /var/adm/crash/crash.2 /nfs/remote/otherdir
To debug this crash dump using tools which do not understand the most
current crash dump format, convert it to the older core directory
Hewlett-Packard Company - 2 - HP-UX Release 11i: November 2000
crashutil -v COREDIR /var/adm/crash/crash.2 /tmp/oldcoredir
or the even older "core file and kernel" format:
crashutil -v COREFILE /var/adm/crash/crash.2 /tmp/corefile
crashutil was developed by HP.
Hewlett-Packard Company - 3 - HP-UX Release 11i: November 2000