« 5.6. Analyse d'un dump » : différence entre les versions
Aller à la navigation
Aller à la recherche
Aucun résumé des modifications |
(Aucune différence)
|
Dernière version du 25 janvier 2013 à 09:39
Analyser un dump mdb -k $KERNEL $CORE
# mdb -k unix.0 vmcore.0 Loading modules: [ unix genunix specfs dtrace ufs ssd fcp fctl emlxs px md mpt sd isp mpt_sas ip hook neti sctp arp usba nca zfs cpc random crypto wrsmd fcip logindmux ptm sppp nfs ipc lofs ] > $C 000002a10efd0771 vpanic(0, 3, 7af45ee0, 2a10efd1178, 47bd8a00, 7af45ee0) 000002a10efd0841 zfs_panic_recover+0x38(7af45ee0, 24, 4b6, 600, 3, 0) 000002a10efd08f1 dmu_buf_hold_array_by_dnode+0xa8(5, 0, 2000, 1, 7af3b93e, 1) 000002a10efd09b1 dmu_read+0xcc(500000, a, 0, 2000, 800003ccdc3ce000, 7af3b800) 000002a10efd0a81 zfs_fillpage+0xf0(2000, 0, 601497bb6b0, 0, 2a10efd1760, 2000) 000002a10efd0b61 zfs_getpage+0x15c(60102888ac0, 601497bb6b0, 1, 0, 2a10efd1760, 2000) 000002a10efd0c41 zfs_shim_getpage+0x40(60102888ac0, 0, 3003b482160, 1, ff380000, 1) 000002a10efd0d21 fop_getpage+0x44(60102888ac0, 600a26396c0, 3003b482160, 1, ff380000, 1) 000002a10efd0df1 segvn_fault+0xb00(2000, 601497bb6b0, 1, 2000, 0, 0) 000002a10efd0fc1 as_fault+0x4c8(601497bb6b0, 30070873738, ff380000, 3007c751468, 18e8e70, 0) 000002a10efd10d1 pagefault+0xac(ff380000, 0, 1, 0, 3007c7513f0, 1) 000002a10efd1191 trap+0xd50(2a10efd1b90, ff3802e0, 0, 1, 115f8, 0) 000002a10efd12e1 utl0+0x4c(ff3803c4, ff380000, ffbff10c, 0, 3c6, 24400) > ::panicinfo cpu 4 thread 3003cc0b080 message zfs: accessing past end of object 24/4b6 (size=1536 access=0+8192) tstate 4400001601 g1 7aefced4 g2 2000 g3 7af45c00 g4 600b4411640 g5 600b4f8e1c0 g6 1 g7 3003cc0b080 o0 7af45ee0 o1 2a10efd1178 o2 1892260 o3 30055788270 o4 16 o5 0 o6 2a10efd0771 o7 114fc78 pc 104bbec npc 104bbf0 y 0 > 3003cc0b080::thread -p ADDR PROC LWP CRED 000003003cc0b080 30055788270 30070873738 3003b482160 > 30055788270::ps -ft S PID PPID PGID SID UID FLAGS ADDR NAME R 991 990 533 533 0 0x4a004000 0000030055788270 tail -1 ./log/100_GENERAL_001_SOLARIS.log T 0x3003cc0b080 <TS_ONPROC> > 0000030055788270::ptree 0000000001892260 sched 00000600a17c1088 init 000006013e7fe5d0 sshd 000006017c3d9918 sshd 000006014f660db8 sshd 000006013e68f2a8 op 000003009eed7b30 cks_0exe.sh 00000600d36e9968 cut 0000030055788270 tail > ::zone ADDR ID NAME PATH 00000000019406f8 0 global / 000006011dbb5980 28 ${VM_NAME} /${VM_NAME}/root/ 00000600d51ab1c0 29 ${VM_NAME} /${VM_NAME}/root/ 00000301195e3840 36 ${VM_NAME} /${VM_NAME}/root/ 0000060182056fc0 37 ${VM_NAME} /${VM_NAME}/root/ 0000060182055980 40 ${VM_NAME} /${VM_NAME}/root/ > 0000030055788270::print proc_t!grep p_zone p_zone = 0x6011dbb5980 > ::ps -ft S PID PPID PGID SID UID FLAGS ADDR NAME R 0 0 0 0 0 0x00000001 0000000001892260 sched T t0 <TS_STOPPED> R 3 0 0 0 0 0x00020001 00000600a17bf848 fsflush T 0x3001171d3a0 <TS_ONPROC> R 2 0 0 0 0 0x00020001 00000600a17c0468 pageout T 0x3001171d6e0 <TS_SLEEP> R 1 0 0 0 0 0x4a004000 00000600a17c1088 /sbin/init T 0x3001171da20 <TS_SLEEP> R 29877 1 29877 29877 0 0x5a006400 00000300560242b8 /soft/UniQPT/programs/servers/xprinter ptip92 T 0x30051698a00 <TS_SLEEP> R 1263 1 29289 29289 44322 0x5a004400 00000300412b0700 bpbkar -L /usr/openv/netbackup/logs/user_ops/dbext /logs/vxbsa.1330837519.191.pr T 0x301f41ced20 <TS_ONPROC> R 1218 1 29289 29289 44322 0x5a004400 0000030179eea648 bpbkar -L /usr/openv/netbackup/logs/user_ops/dbext/logs/vxbsa.1330837519.191.pr T 0x300a137d1a0 <TS_ONPROC> R 1186 1 29289 29289 44322 0x5a004400 0000030089472158 bpbkar -L /usr/openv/netbackup/logs/user_ops/dbext/logs/vxbsa.1330837519.191.pr T 0x3003e3655a0 <TS_ONPROC> R 1172 1 29289 29289 44322 0x5a004400 00000300d0970338 bpbkar -L /usr/openv/netbackup/logs/user_ops/dbext/logs/vxbsa.1330837519.191.pr T 0x3009d23b8c0 <TS_ONPROC> R 1093 1 29289 29289 44322 0x5a004400 000006010fb57270 bpbkar -L /usr/openv/netbackup/logs/user_ops/dbext/logs/vxbsa.1330837519.191.pr T 0x3021752cb40 <TS_SLEEP> R 859 1 29289 29289 44322 0x5a004400 0000030166904d20 bpbkar -L /usr/openv/netbackup/logs/user_ops/dbext/logs/vxbsa.1330837519.191.pr T 0x30028262540 <TS_SLEEP> R 188 1 26455 26455 44322 0x4a004400 00000301639719d8 /usr/sap/PO1/SYS/exe/run/brconnect -S 26455 T 0x3010127a5c0 <TS_SLEEP> Z 300 188 300 300 44322 0x4a004002 000003005616da90 oraclePO1 (DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq))) R 26353 1 26353 26353 0 0x4a004400 000006016cdec130 bphdb -sb -rdbms sap -S pyasej -to 3600 -c pyasg7_isapbw_po1 -s FULL -clnt pyas T 0x30069a92020 <TS_SLEEP> R 26354 26353 26353 26353 0 0x4a004000 00000300d09ae4b8 /bin/sh /users/nbk00/exploit/script/nbk_0ls.sh >/dev/null 2>/dev/null T 0x300fcea60e0 <TS_SLEEP> R 26361 26354 26353 26353 0 0x4a004000 0000030166513960 /bin/sh /users/nbk00/exploit/script/nbk_0os.sh T 0x30011f8a500 <TS_SLEEP> R 26381 26361 26353 26353 44322 0x4a014000 00000300fc5c3990 -csh -c setenv SAP_SERVER pyasej; setenv SAP_CLASS pyasg7_isapbw_po1; brbackup T 0x300a25b8440 <TS_SLEEP> R 26455 26381 26455 26455 44322 0x4a004000 000003016690cd10 brbackup -c force -u / -p initPO1.sapdata.offline.bw.sap -m all T 0x300a05fa460 <TS_SLEEP> R 190 26455 26455 26455 44322 0x4a004000 000006014f6619d8 sh -c ( /usr/sap/PO1/SYS/exe/run/backint -u PO1 -f backup -i /oracle/PO1/sapbac T 0x300c7167540 <TS_SLEEP> R 191 190 26455 26455 44322 0x4a004000 00000600a2dc0c60 /usr/sap/PO1/SYS/exe/run/backint -u PO1 -f backup -i /oracle/PO1/sapbackup/.bei T 0x301fdfef7a0 <TS_SLEEP> R 203 191 26455 26455 44322 0x42000000 00000300d09a24d0 /usr/sap/PO1/SYS/exe/run/backint -u PO1 -f backup -i /oracle/PO1/sapbackup/.bei T 0x3009f65c840 <TS_SLEEP> R 202 191 26455 26455 44322 0x42000000 00000600d2769950 /usr/sap/PO1/SYS/exe/run/backint -u PO1 -f backup -i /oracle/PO1/sapbackup/.bei T 0x3001295e3e0 <TS_SLEEP> R 201 191 26455 26455 44322 0x42000000 000003013d6fe230 /usr/sap/PO1/SYS/exe/run/backint -u PO1 -f backup -i /oracle/PO1/sapbackup/.bei T 0x3006a298de0 <TS_SLEEP> R 200 191 26455 26455 44322 0x42000000 000003016690c0f0 /usr/sap/PO1/SYS/exe/run/backint -u PO1 -f backup -i /oracle/PO1/sapbackup/.bei T 0x300a1ade700 <TS_SLEEP> R 199 191 26455 26455 44322 0x42000000 000006010f8cc200 /usr/sap/PO1/SYS/exe/run/backint -u PO1 -f backup -i /oracle/PO1/sapbackup/.bei T 0x30158d96220 <TS_SLEEP> R 198 191 26455 26455 44322 0x42000000 00000300878c6ca8 /usr/sap/PO1/SYS/exe/run/backint -u PO1 -f backup -i /oracle/PO1/sapbackup/.bei T 0x3003750bc80 <TS_SLEEP> R 5441 1 5441 5441 9009 0x4a004400 0000030166921908 oracleDSM00 (DESCRIPTION=(LOCAL=no)(ADDRESS=(PROTOCOL=BEQ))) T 0x3015e54d6c0 <TS_SLEEP> R 5439 1 5439 5439 9009 0x4a004400 00000300d09fe518 oracleDSM00 (DESCRIPTION=(LOCAL=no)(ADDRESS=(PROTOCOL=BEQ))) T 0x300837bc760 <TS_SLEEP> R 5437 1 5437 5437 9009 0x4a004400 00000300d099d8b8 oracleDSM00 (DESCRIPTION=(LOCAL=no)(ADDRESS=(PROTOCOL=BEQ))) T 0x301fb7f5040 <TS_SLEEP> R 5435 1 5435 5435 9009 0x4a004400 00000600d2b7c118 oracleDSM00 (DESCRIPTION=(LOCAL=no)(ADDRESS=(PROTOCOL=B T 0x300bf51eb20 <TS_SLEEP> R 5433 1 5433 5433 9009 0x4a004400 00000300fa9be250 oracleDSM00 (DESCRIPTION=(LOCAL=no)(ADDRESS=(PROTOCOL=B T 0x300114614c0 <TS_SLEEP> > 30055788270::ps S PID PPID PGID SID UID FLAGS ADDR NAME R 991 990 533 533 0 0x4a004000 0000030055788270 tail > $ > 30055788270::ps -aef mdb: illegal option -- a Usage: ps [-fltzTP] > 30055788270::ps -fltz S PID PPID PGID SID ZONE UID FLAGS ADDR NAME R 991 990 533 533 28 0 0x4a004000 0000030055788270 tail -1 ./log/100_GENERAL_001_SOLARIS.log T 0x3003cc0b080 <TS_ONPROC> L 0x30070873738 ID: 1 > ::ps > ::zone ADDR ID NAME PATH 00000000019406f8 0 global / 000006011dbb5980 28 ${VM_NAME} /${VM_NAME}/root/ 00000600d51ab1c0 29 ${VM_NAME} /${VM_NAME}/root/ 00000301195e3840 36 ${VM_NAME} /${VM_NAME}/root/ 0000060182056fc0 37 ${VM_NAME} /${VM_NAME}/root/ 0000060182055980 40 ${VM_NAME} /${VM_NAME}/root/ > 0000030055788270::print proc_t!grep p_zone p_zone = 0x6011dbb5980 > 30055788270::ps -fltzT S PID PPID PGID SID TASK ZONE UID FLAGS ADDR NAME R 991 990 533 533 359639 28 0 0x4a004000 0000030055788270 tail -1 ./log/100_GENERAL_001_SOLARIS.log T 0x3003cc0b080 <TS_ONPROC> L 0x30070873738 ID: 1 > 30055788270::ps -fltzTP S PID PPID PGID SID TASK PROJ ZONE UID FLAGS ADDR NAME R 991 990 533 533 359639 3 28 0 0x4a004000 0000030055788270 tail -1 ./log/100_GENERAL_001_SOLARI T 0x3003cc0b080 <TS_ONPROC> L 0x30070873738 ID: 1
Autre exemple:
ll > ::panicinfo cpu 7 thread fffffebbd3ce2c60 message BAD TRAP: type=e (#pf Page fault) rp=fffffe8011496c40 addr=c96610d2 occurred in module "unix" due to an illegal access to a user address rdi c96610d2 rsi fffffeb60b4418d0 rdx fffffebbd3ce2c60 rcx fffffeb60b4418d0 r8 0 r9 0 rax 71 rbx c96610d2 rbp fffffe8011496d50 r10 34 r10 34 r11 fffffffffbd18460 r12 ffffffffa0e3f600 r13 ffffff286cd33bb8 r14 d r15 fffffe8011496e50 fsbase ffffffff80000000 gsbase ffffffffa4c2a000 ds 43 es 43 fs 0 gs 1c3 trapno e err 0 rip fffffffffb836310 cs 28 rflags 10206 rsp fffffe8011496d38 ss 30 gdt_hi 0 gdt_lo defacedd idt_hi 0 idt_lo d0000fff ldt 0 task 60 cr0 80050033 cr2 c96610d2 cr3 182c345000 > fffffebbd3ce2c60::thread -p ADDR PROC LWP CRED fffffebbd3ce2c60 fffffeb2a09488d8 ffffff60d65de0b0 fffffeb62b0d0830 > fffffeb2a09488d8::ps -ft S PID PPID PGID SID UID FLAGS ADDR NAME R 23089 23087 141 141 0 0x4a004000 fffffeb2a09488d8 format /dev/rdsk/c0t60050768018E826F5000000000000C58d0s2 T 0xfffffebbd3ce2c60 <TS_ONPROC> T 0xfffffeb266c698c0 <TS_SLEEP> T 0xfffffeb2a4e4b760 <TS_SLEEP> T 0xfffffed3808538c0 <TS_ONPROC> > fffffeb2a09488d8::ptree fffffffffbc27720 sched ffffffffa3745348 init fffffeb271dcd6f0 Lance_get_all.sh fffffeb29d9058f8 get_disques.sh fffffeb25ee0e1f0 dc fffffeb2a09488d8 format > fffffeb271dcd6f0::ps -ft S PID PPID PGID SID UID FLAGS ADDR NAME R 19197 1 141 141 0 0x4a004000 fffffeb271dcd6f0 ${ICI SERA LE NOM DU PROCESS} T 0xfffffeb2d5d8c780 <TS_SLEEP>