WAE Core Dump File

Unanswered Question
Jul 4th, 2009

Hi all,

I've been searching to recovering this core dump, but im not sure if it will work, and dont know if i could reboot the appliance after copy the core dump file.

Didnt found any related document too, so if any one could link me some about this, i'll apreciate it.

Best Regards,

Bruno Petrónio


cm1#show alarms detail support

Critical Alarms:



Major Alarms:


Alarm ID Module/Submodule Instance

-------------------- -------------------- --------------------

1 core_dump sysmon core

May 20 15:03:50.606 WEST, Processing Error Alarm, #000001, 1000:445001

Kernel Crash files and / or User Core files detected


A user core file or kernel crash dump has been generated.


The System Monitor issues this to indicate that one or more

of the software modules or the kernel has generated core



Access the device and check the directory /local1/core_dir,

or /local1/crash, retrieve the core file through ftp and

contact Cisco TAC.

Minor Alarms:


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
dstolt Mon, 07/06/2009 - 10:00


The core dump is usually written to disk and is a physical file you can ftp off. Once the file is written to the disk, you will get an alarm in the CLI or GUI until the file is removed. The service that wrote the file should restart and you should be operational as soon as the file is written. If you want to see what caused this issue, the file can be decoded by the TAC, although the file name itself usually tells you what process initiated the core file.

Hope that helps,


b.petronio Tue, 07/07/2009 - 13:42

Tks for your precious help, once more.

The extracted file, is readable from commum "applications" ? for a 1st analisys, before send it to TAC ?

Best Regards,

Bruno Petrónio

dstolt Tue, 07/07/2009 - 13:47

No, it's not readable by any application that I know of outside of Cisco.

I usually go by what the name of the file is and compare to known issues/DDTS.


mmoulson1 Tue, 06/15/2010 - 06:14

Hi I have a customer who is getting the 'Kernel Crash files and / or User Core files detected’ error message.

Please can someone provide instructions (exact syntax please) for removing the files so it clears the error. This started after the box was powered off accidentally.

Many thanks in advance.

Zach Seils Wed, 06/16/2010 - 06:33

The files are written in the core_dir directory.  You can delete the file(s) with the command:




mmoulson1 Wed, 06/16/2010 - 08:22

Thanks Zach,

I don’t have access the device so have passed this on for the person onsite to try! I will let you know the outcome.

Many thanks for the prompt response.


mmoulson1 Thu, 06/17/2010 - 00:46

Hi Zach,

Please see below output is the .gz file the dump file we need to remove?

Thanks again.


Dev1#cd /local1/core_dir



Zach Seils Fri, 06/18/2010 - 14:07

Yes, removing that file will remove the alarm.

Have you saved a copy of the file so it can be analyzed by Cisco?


mmoulson1 Mon, 07/05/2010 - 04:02

Zach, removing the file did clear the error. Unfortunately the customer has deleted it without making a copy so we are not able to submit it for analysis.

Many thanks for your support.



This Discussion