Retrieving crashinfo from flash on a PIX 525, 6.3(3)

[dro]

Hey all, I have a PIX 525 that crashed on me twice today, running 6.3(3). In both cases the crashinfo file generated is corrupt. Is there any way to retrieve the partial file from flash to have a look at it?

The file definately does exist, but I can't do anything with it on the PIX:

psifw01# show crashinfo

Show crashinfo failed: bad or missing header magic number

psifw01# show flash

flash file system: version:3 magic:0x12345679

file 0: origin: 0 length:1941560

file 1: origin: 1966080 length:47935

file 2: origin: 2228224 length:1921

file 3: origin: 2359296 length:4748324

file 4: origin: 7208960 length:131072

file 5: origin:16646144 length:308

My secondary (currently active) PIX 525 shows the following under a show flash:

psifw02# show crashinfo

No crash file found.

psifw02# show flash

flash file system: version:3 magic:0x12345679

file 0: origin: 0 length:1941560

file 1: origin: 1966080 length:47934

file 2: origin: 2228224 length:1927

file 3: origin: 2359296 length:4748324

file 4: origin: 0 length:0

file 5: origin:16646144 length:308

In this case, is file 4 the crashinfo? Or is it also the "flashfs downgrade information for the show flashfs command" as posted in the 'PIX 515e "show flash"' thread.

Thanks.

Joshua

[scoclayton]

Joshua,

Interesting. I have seen this message a few other times but am not sure of the cause. Can you issue a 'clear crashinfo' on the primary PIX (in config mode) and wait for another crash and failover? Then try gathering the 'sh crashinfo' output?

As for the sh flash output, the info I posted earlier was for a pre-6.3 PIX. The file system changed in 6.3 so you are correct that file 4 is the crashinfo on a PIX running 6.3. See the table below:

PIX Ver 6.2 and lower (ver 2 filesystem)

file 0: PIX binary image

file 1: startup config

file 2: IPSec key and certificate information

file 3: PDM image

file 4: filesystem record

PIX Ver 6.3 and higher (ver 3 filesystem)

file 0: PIX binary image

file 1: startup config

file 2: IPSec key and certificate information.

file 3: PDM image

file 4: Crashinfo (last saved traceback and show tech output)

file 5: filesystem record

Scott

[dro]

Hi Scott,

This is already the second time it's happened. The first time it happened yesterday, I also wasn't able to view the crashinfo file, so I cleared it off. The second time it happened it was the same thing.

I'm trying to determine what the cause might be at the moment, but it's not always that easy if I can't read the file ;-)

Would it be safe to say that if the file was created in the first place, it's a software based crash?

The only other information I can find on the crash is that the secondary reported "no power detected from mate" and took charge.

Thanks,

-Joshua

[scoclayton]

Joshua,

OK, got ya. I was hoping this would help but I guess not. Yes, you can assume that this was a software forced crash. The fact that you see something in file 4 on the flash and the syslog message from the failover PIX, make this an almost certainty. The only other option I can think of would be to setup a machine that is constantly logged into the console on the problem PIX. If the PIX should crash again, the crashdump should be displayed to the console. Set your console session to capture the whole session to make sure you get the info. Once you get the crashdump, open a TAC case so that our engineers can decode the crash for you and also dignose the 'sh crashinfo' problem. Sorry for the issues. Good luck!

Scott

[dro]

Thats too bad..

Thanks anyways. I'll have to dig around to find some machines I can record console output to.

-Joshua