Enabling Coredump on the ASA

Document

Feb 24, 2011 12:26 PM
Feb 24th, 2011


Purpose

Current traceback information saved on the ASA after a crash does not  always provide enough information to determine the root cause of the  problem. The coredump is a system-wide snapshot of the ASA memory at the time when a  crash occurs. Coredumps are saved to disk allowing the administrator to export  it later for off-site analysis by Cisco TAC and Development.

Things to know before configuring a coredump

Why should I configure a coredump?

Typically, the coredump feature will be recommended by support when troubleshooting the cause of a new crash. The coredump is meant provide additional information when the contents of the crashinfo are not adequate to fix the crash

Where do coredumps go?

All coredumps are written to the ASA flash file system.  Currently that means either disk0:, flash:, or disk1: (where disk0: and flash: equate to the same media).

How much disk/flash space is currently available on your system?

Before enabling coredump, it is important to be  aware of how much disk space is currently available on the system. If disk space is tight on your ASA, then coredumps are not an option. The amount of disk space allocated for coredumps is currently based on the ASA platform and it's typical memory configuration.

Coredump Default Disk Size Settings:

  • 60 MB for ASA5505, ASA5510, ASA552
  • 100MB for ASA5540
  • 200MB for ASA5550, ASA5580

If the default coredump is too large to fit in the available flash memory, the ASA will give an error.

Ex:

ERROR: Desired filesystem space size 60 MB is more
than available 7 MB on filesystem disk0:

If there is not enough space, check to see if any old files that are no longer in use can be removed. If there is still not enough room, then the above  values may be manually configured and reduced. Note: It is inadvised to go below  1/2 of the default values as the chances of truncating the coredump early are greatly increased. A truncated coredump is of no use and will be removed automatically by  the ASA code at the time of occurrence.

What happens when the preallocated space for coredumps fills up?

When the ASA code detects the pre-allocated space is full, it  will go through & remove older accumalated coredumps. It removes the oldest coredump first and will then try and continue writing the current coredump. If more space is required, it will continue removing previous coredumps if necessary.

If the ASA gets to the point that all previous coredumps have been removed and we still cannot fit the current coredump, then the current coredump will be aborted, anything written to disk removed, and the coredump log will be updated with what happened.

Configuration

CLI Commands

     coredump enable

When coredumps are enabled the following file elements get  created on the specified filesystem (disk0:, disk1:, flash:) and should never be manipulated explicitly by the user:

coredumpfsys – directory containing coredump images
coredumpfsysimage.bin – coredump filesystem image used to manage coredumps
coredumpinfo – directory containing the coredump log

This example is the simplest case.  Basically a user just has  to enable the feature. Entering the filesystem & size are optional.

ciscoasa(config)#coredump enable

WARNING: Enabling coredump on an ASA5505 platform will delay the reload of the system in the  
event of software forced reload. The exact time depends on the size of the coredump generated.

Proceed with coredump filesystem allocation of 60 MB
on 'disk0:' (Note this may take a while) ? [confirm]

Making coredump file system image!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Coredump file system image created & mounted successfully

/dev/loop0 on /mnt/disk0/coredumpfsys type vfat
(rw,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1)

Note 1: "disk0:" is always the default, with the size being platform dependent (this being on an ASA5505).

Note 2: Each bang ‘!’ in these examples represents 1 MB of the coredump filesystem being written.

Explicitly creating a 120 MB coredump filesystem on disk1:

User resizes the coredump filesystem. In this example, user resizes a 120 MB coredump filesystem to 100 MB on an ASA5540. 
Note: The contents of the 120 MB coredump filesystem are not preserved, so make sure to archive previous coredumps before resizing your coredump filesystem.
ciscoasa(config)# coredump enable filesystem disk1: size 100

WARNING: Enabling coredump on an ASA5540 platform will delay the reload of the system in the 
event of software forced reload. The exact time depends on the size of the coredump generated.

Proceeding with resizing to 100 MB results in
deletion of current 120 MB coredump filesystem and
its contents on 'disk1:', proceed ? [confirm]

Making coredump file system image!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Coredump file system image created & mounted successfully

/dev/loop0 on /mnt/disk1/coredumpfsys type vfat
(rw,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1)

PLEASE MAKE SURE TO SAVE YOUR CONFIG WHENEVER ENABLING/DISABLING COREDUMPS!!!!!

     no coredump enable

User disables coredump functionality:

ciscoasa(config)# no coredump enable

This command will disable coredumps temporarily (until re-enabled). This does not effect the coredump filesystem and its contents. This DOES CHANGE THE CONFIG!!! Please save the config after performing this operation.

To re-enable coredumps, just enter the command you originally used to configure the coredump filesystem.

Troubleshooting/Debugging

Show commands

     show coredump filesystem

This command displays any files on the coredump filesystem, also  giving you a clue as to how full it might be. A word of advice: please  archive the coredump files when convenient as it is possible a  subsequent coredump could lead to previous coredump(s) being removed to  fit the current core.

ciscoasa# show coredump filesystem

Coredump Filesystem Size is 100 MB

Filesystem type is FAT for disk0

Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/loop0              102182     75240     26942  74% /mnt/disk0/coredumpfsys

Directory of disk0:/coredumpfsys/

246    -rwx  20205386    19:16:44 Nov 26 2008  core_lina.1227726922.258.11.gz
247    -rwx  36707919    19:21:56 Nov 26 2008  core_lina.1227727222.258.6.gz
248    -rwx  20130838    19:26:36 Nov 26 2008  core_lina.1227727518.258.11.gz
     show coredump log

When a coredump file is created, messages are added to the coredump.log file in disk0:/coredumpinfo.  Use the show coredump log command to display the contents of the log file.  The messages should  reflect what's currently on the disk. It provides quick feedback on  coredumps which have happened. You can also see the  compressed/uncompressed size of the coredump, timestamp of when the core  happened, as well as how long it took to dump the core image.

ciscoasa# show coredump log

[ 1 ] Wed Nov 26 19:26:37 2008: Coredump completed  for module 'lina', coredump file 'core_lina.1227727518.258.11.gz', size 974753792 bytes, compressed size 20130838

[ 2 ] Wed Nov 26 19:25:18 2008: Coredump started for module 'lina', generating coredump file 'core_lina.1227727518.258.11.gz' on 'disk0'

[ 3 ] Wed Nov 26 19:21:56 2008: Coredump completed  for module 'lina', coredump file 'core_lina.1227727222.258.6.gz', size 974753792 bytes, compressed size 36707919

[ 4 ] Wed Nov 26 19:20:22 2008: Coredump started for module 'lina', generating coredump file 'core_lina.1227727222.258.6.gz' on 'disk0'

[ 5 ] Wed Nov 26 19:16:44 2008: Coredump completed  for module 'lina', coredump file 'core_lina.1227726922.258.11.gz', size 974753792 bytes, compressed size 20205386

[ 6 ] Wed Nov 26 19:15:22 2008: Coredump started for module 'lina', generating coredump file 'core_lina.1227726922.258.11.gz' on 'disk0'

Syslog Messages

  • %ASA-6-741000: Coredump filesystem image created on

Physical coredump filesystem has been created/allocated and is now ready for use.

  • %ASA-6-741001: “disk:  Coredump filesystem image on %s – resized from start_size MB to new_size MB

Physical coredump file system image  has been resized.

  • %ASA-6-741002: “disk:  Coredump log and filesystem  contents cleared on %s

Removed all contents in the current coredump file system image directory, while also clearing the log.

  • %ASA-6-741003: “disk:  Coredump filesystem and it’s contents removed on %s

Removes entire coredump filesystem and it’s contents. Also clears the coredump log.

  • %ASA-6-741004: “disk:  Coredump configuration reset to default values

Coredump configuration is reset to it’s default values. The coredump  filesystem and it’s contents remain untouched. The coredump log is  untouched as well.

  • %ASA-4-741005: Coredump operation operation failed with error error

Indicates an internal coredump error occurred manipulating the  coredump filesystem. If this error is observed please forward to Cisco  TAC.

  • %ASA-4-741006: Unable to write Coredump Helper configuration, reason reason

An error occurred writing the  coredump helper configuration.  Indicates either "disk0” is full or memory was not available to write  the file. Please check your flash space and available memory.

1. How do I get a coredump off my box?

You can transfer a coredump as you would any other ASA file, using copy tftp from the CLI or file transfer via ASDM. Here is an example from an ASA5505 using the CLI:

ciscoasa# show coredump filesystem 

Coredump Filesystem Size is 30 MB

Filesystem type is FAT for disk0

Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/loop0               30642      7224     23418  24% /mnt/disk0/coredumpfsys


Directory of disk0:/coredumpfsys/

134    -rwx  7395867     14:13:50 Nov 26 2008  core_lina.1227708696.233.11.gz

127135744 bytes total (77815808 bytes free)

ciscoasa# copy disk0:/coredumpfsys/core_lina.1227708696.233.11.gz tftp://10.10.10.10

Source filename [/coredumpfsys/core_lina.1227708696.233.11.gz]?

Address or name of remote host [10.10.10.10]?

Destination filename [core_lina.1227708696.233.11.gz]?
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!etc.......
Average Rating: 5 (4 ratings)

Actions

Login or Register to take actions

This Document

Posted February 24, 2011 at 12:26 PM
Stats:
Comments:0 Avg. Rating:5
Views:9810 Contributors:0
Shares:0
Tags: No tags.

Documents Leaderboard