Kernel core dumps (was Re: out of swap space??)

[j chapman flack]

>| > [this was my original question]

In article <1991May4.232044.3487 at NCoast.ORG> allbery at ncoast.ORG (Brandon S. Allbery KB8JRR/AA) writes:
>As quoted from <1991May04.132158.17121 at turnkey.tcc.com> by jackv at turnkey.tcc.com (Jack F. Vogel):
>+---------------
>| > It would have been handy to be able to run something as root that
>| >forces a panic, then reboot and analyze the dump while the system is still
>| >reasonably reliable.
>|  
>| Again, I can't speak for SCO's implementation, but one way to do this
>| given the AT&T standard is to have the kernel debugger linked into your
>| kernel (see debugger(8)) and then if you want to force a dump, enter
>+---------------
>
>Alternatively, if all you want to do is look at running kernel information
>without playing any games with it, try "/etc/crash /dev/kmem".  

One person suggested using the kernel debugger; several suggested using
`crash' to look at the running system.  I don't have a development system
and I haven't found anything lying around that looks like a kernel debugger,
so I doubt that linking that in is an option for me.

I have, on occasion, used `crash' to look at the running system.  However,
I expect that the time I'll *really* want to look at things will be when
response time has suddenly gone to six minutes and rising, or the console
is being flooded with messages, or something else obnoxious is happening.
(I've had such experiences before, with other systems....)

What I want in a situation like that, if there's still any chance I can log
in as root and get one command executed, is one command that will simply
force a panic, like OPCCRASH did on the VAX 11/780 console.  After the
system is rebooted and stable (or I've taken the dump to a stable system)
...THEN I'll try to make sense of the dump.

>You don't even
>have to panic the system (but you *will* if you try to change things).

Hmm.  My man page for `crash' doesn't mention any way to change anything.
If it did, that would be just the ticket.  As I remember, OPCCRASH just
set the stack level indicator to the interrupt stack, put -1 into IP,
and resumed.  The deed was done....  Is there some undocumented way to
modify things with `crash'?
-- 
Chap Flack                         Their tanks will rust.  Our songs will last.
chap at art-sy.detroit.mi.us                                    -MIKHS 0EODWPAKHS

Nothing I say represents Appropriate Roles for Technology unless I say it does.