CRASH(8) | System Manager's Manual | CRASH(8)

# NAME

`crash` —
examine and debug system images

# SYNOPSIS

`crash` | [`-w`] [`-M` core] [`-N` kernel]

# DESCRIPTION

The `crash` command is used to examine and debug system images.

If run without any arguments, `crash` operates on the running system.

The options are as follows:

`-M` core
  Operate on the specified crash dump instead of the default /dev/mem. Crash dumps should be from the same version of the system and same machine architecture as the running version of `crash`, and must be uncompressed.
`-N` kernel
  Extract the name list from the specified kernel instead of the default /dev/ksyms.
`-w`
  Enable writing.

The command syntax used by `crash` is the same as the in-kernel debugger. See the ddb(4) manual page for more information.

Operations and facilities that require a running system, such as breakpoints, are not supported by `crash`.

`crash` does not provide pagination. However, by using the pipe symbol, output may be sent to commands available from the shell. For example:

    crash> ps | more
    crash> ps | grep ioflush

# EXAMPLES

You can obtain a full list of all kernel stack traces with a shell pipeline like the following:

    # echo ps | crash | grep '^[0-9]' | cut -c 30-46 | \
      sed 's,^,bt/a ,' | crash

# SEE ALSO

ps(1), vmstat(1), ddb(4), pstat(8)

# HISTORY

The `crash` command appeared in NetBSD 6.0.

# BUGS

The `crash` command for the sparc port is unstable.

March 22, 2019 | NetBSD 9.5