cvs commit: src/sys/ddb db_command.c db_output.c

[Robert Watson]

On Mon, 3 Oct 2005, Nate Lawson wrote:

>> Is there any chance I can interest you in an idea phk, I, and a few 
>> others have been kicking around for a bit relating to smart small 
>> dumps? Specifically, we were discussing the idea of allowing a dumping 
>> mode in which rather than dumping all of kernel memory, we dump 
>> specifically the common and useful output from ddb, such as ps, show 
>> locked vnods, show alllocks, traceall, show allpcpu, and so on, 
>> basically in text format, to the dump partition.  Then the results can 
>> be pulled off easily in a format that is appropriate for e-mailing or 
>> submitting via a PR, even without a full debugging kernel, etc.  Among 
>> other things, these dumps would be much, much smaller than a memory 
>> dump, meaning they could be kept around like log files 
>> (/var/log/crash.log.0, ...), be e-mailed to the sysadmin, etc.  It 
>> would require some new magic in DDB and the dumping code, but almost 
>> all of the logic to generate the information from DDB could be reused, 
>> perhaps via an alternative pager or debug output device :-).
>
> That's fine as a hack-around, but I hope that doesn't distract effort 
> from sparse kernel dumps.  If you throw out non-anonymous pages, buffer 
> cache, etc., you end up with a very small image to begin with.  Add in 
> gzip compression and it wouldn't be much larger than your uncompressed 
> logs.  Then you can run whatever info tools you want against the core 
> since no actual data is lost.

Actually, there's an important feature difference here is that you get 
something that is potentially much more useful/persistent in the long run. 
To make use of a kernel core dump, you need a gdb version that understands 
the target architecture, a compiled kernel that matches the core, source 
that matches the kernel, etc.  In absense of these things, the core is a 
pile of bytes that, with a high level of effort, you can try to extract 
data from -- especially if it was built months or years ago.  The idea 
behind these mini dumps is that because you're in the kernel run-time 
environment and the dump generating code is compiled with the kernel that 
crashed, it can actually do some of the interpretation and data extraction 
up front, providing many of the details needed for a bug report without 
requiring use of gdb, kernel compiles, source trees, and so on.  Sure, 
you'll need those things if you want to get back to line numbers, so it's 
not a substitute for a full dump, but it would be quite handy.  I debug 
very few problems using a full dump, in part because they are so 
inconvenient to deal with -- it's hardly ever the size, it's the 
complexity of trying to get architectures, source versions, kernel 
configurations, etc, aligned.

Robert N M Watson