Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

Determining name of a crash core file which includes the crash time in hex

The crash core file name includes, amongst other text, the card number, cpu number, and the time in hex. While the output from show crash number X displays the actual friendly date/time, the actual log entry, IF you have access to it, will show the time converted to hex. For example the following logs show the converted hex time in parentheses:

2013-Feb-17+00:20:04.413 [sitmain 4075 trace] [8/0/4428 <sitparent:80> crashd.c:582] [software internal system critical-info syslog] Crash handler file transfer ended (type=2 size=0 child_ct=0 core_ct=0 pid=30237 status=1 elapsed=197s)

2013-Feb-17+00:16:47.550 [sitmain 4074 trace] [8/0/4428 <sitparent:80> crashd.c:861] [software internal system critical-info syslog] Crash handler file transfer starting (type=2 size=0 child_ct=1 core_ct=1 pid=30237)
2013-Feb-17+00:16:47.537 [system 1001 error] [8/0/4430 <evlogd:0> evlgd_syslogd.c:155] [software internal system syslog] CPU[4/0]:  xmitcore[30374]: Core file transmitted to card 8; sz=64958121 elapsed=16s.
2013-Feb-17+00:16:47.536 [sitmain 4080 info] [8/0/4428 <sitparent:80> crashd.c:822] [software internal system critical-info syslog] Core file transfer to SPC complete, received 64958121/0 bytes
2013-Feb-17+00:16:33.263 [sitmain 4075 trace] [8/0/4428 <sitparent:80> crashd.c:582] [software internal system critical-info syslog] Crash handler file transfer ended (type=1 size=75292 child_ct=0 core_ct=1 pid=30187 status=1 elapsed=0s)
2013-Feb-17+00:16:33.156 [sitmain 4074 trace] [8/0/4428 <sitparent:80> crashd.c:861] [software internal system critical-info syslog] Crash handler file transfer starting (type=1 size=75292 child_ct=1 core_ct=1 pid=30187)
2013-Feb-17+00:16:33.143 [sitmain 4080 info] [8/0/4428 <sitparent:80> crashd.c:822] [software internal system critical-info syslog] Core file transfer to SPC complete, received 75292/75292 bytes
2013-Feb-17+00:16:33.141 [sitmain 4027 critical] [4/0/3419 <sitmain:40> crash_mini.c:823] [software internal system callhome-crash] Process Crash Info: time 2013-Feb-17+00:16:31(hex time 5120215f) card 04 cpu 00 pid 05300 procname sessmgr  crash_details
Fatal Signal 11: Segmentation fault
  PC: [070d76a8/X] acs_recover_video_info()
  Faulty address: 0x120
  Signal detail: address not mapped to object
  Process: card=4 cpu=0 arch=X pid=5300 cpu=~33% argv0=sessmgr
  Crash time: 2013-Feb-17+00:16:31 UTC
  Recent errno: 11 Resource temporarily unavailable

[local]CHASSIS-NAME HA> show crash list

==         ====         =======  ========== =========== ================

#          Time         Process   Card/CPU/     SW         HW_SER_NUM

                                     PID      VERSION   SMC / Crash Card

==         ====         =======  ========== =========== ================

24 2013-Feb-17+00:16:31 sessmgr  04/0/05300 12.3(46467) SAD152200WT/PLB49091101

The hex time can actually be calculated as follows, first converting the human readable time to unix epoch time (decimal format) using either Unix command line or the Epoch Converter at http://www.epochconverter.com/, and then converting to hex (using for example Windows calculator in Programmer mode):

$ TZ=UTC date -d "2013-02-17 00:16:31" +%s

1361060191

1361060191 = 0x5120215f

Note the name of the generated file has the hex value. It also is preceded by a chassis name which is optionally configured in the crash enable configuration line. The timestamp of the core file is just over 6 hours behind the actual UTC time of the crash due to this unix server being set to Central Standard Time (UTC - 6) plus the approximately 4 minutes it took to actually transfer the file (see logs above confirming this):

-rw-r--r--   1 postgres postgres 57523566 Feb 16 18:20 CHASSIS-NAME-crash-04-00-5120215f-core.gz

Version history
Revision #:
1 of 1
Last update:
‎02-17-2013 08:44 AM
Updated by:
 
Everyone's tags (1)