如何在 Ubuntu 12.04 上读取崩溃文件？

Posted 2023-02-22

【中文标题】如何在 Ubuntu 12.04 上读取崩溃文件？

【英文标题】：How can I read a crash file on Ubuntu 12.04?

【发布时间】：2014-03-15 01:35:44

【问题描述】：

php5-fpm 崩溃了，我们想了解当时正在执行什么。我们无法从 xdebug 中得到它，因为它已经在生产中发生了。

我将故障实例的驱动器安装到另一个 (/mnt) 并尝试读取崩溃文件：

版本信息

root@dev:/mnt/var/crash# cat /mnt/etc/lsb-release 
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=12.04
DISTRIB_CODENAME=precise
DISTRIB_DESCRIPTION="Ubuntu 12.04.4 LTS"

尝试使用 gdb .. 打开崩溃文件，但无法识别：

root@dev:/mnt/var/crash# gdb /mnt/usr/sbin/php5-fpm _usr_sbin_php5-fpm.1002.crash 
GNU gdb (Ubuntu/Linaro 7.4-2012.04-0ubuntu2.1) 7.4-2012.04
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.launchpad.net/gdb-linaro/>...
Reading symbols from /mnt/usr/sbin/php5-fpm...(no debugging symbols found)...done.
"/mnt/var/crash/_usr_sbin_php5-fpm.1002.crash" is not a core dump: File format not recognized

然后尝试崩溃：

root@dev:/mnt/var/crash# crash _usr_sbin_php5-fpm.1002.crash 

crash 6.1.6
Copyright (C) 2002-2013  Red Hat, Inc.
Copyright (C) 2004, 2005, 2006, 2010  IBM Corporation
Copyright (C) 1999-2006  Hewlett-Packard Co
Copyright (C) 2005, 2006, 2011, 2012  Fujitsu Limited
Copyright (C) 2006, 2007  VA Linux Systems Japan K.K.
Copyright (C) 2005, 2011  NEC Corporation
Copyright (C) 1999, 2002, 2007  Silicon Graphics, Inc.
Copyright (C) 1999, 2000, 2001, 2002  Mission Critical Linux, Inc.
This program is free software, covered by the GNU General Public License,
and you are welcome to change it and/or distribute copies of it under
certain conditions.  Enter "help copying" to see the conditions.
This program has absolutely no warranty.  Enter "help warranty" for details.

crash: _usr_sbin_php5-fpm.1002.crash: not a supported file format

文件本身有一些基本信息，但其内容似乎是 base64 编码的：

[...]
Signal: 11
Uname: Linux 3.2.0-59-virtual x86_64
UserGroups:
CoreDump: base64
 H4sICAAAAAAC/0NvcmVEdW1wAA==
[...]

知道如何阅读此内容吗？

【问题讨论】：

crash 用于内核故障转储，而不是进程核心转储。使用调试器进行核心转储，例如gdb。但要使用它做任何有用的事情，您需要一个带有调试符号的可执行文件。

@Barmar .. 所以我在崩溃时无法通过这个崩溃文件获得系统调用的堆栈跟踪？多么没用..

【参考方案1】：

您想阅读“如何使用这些崩溃报告？”部分here。

使用apport-unpack 解压核心转储，GDB 将能够对其进行分析。