topic Re: How to handle core-dumps and crash dumps in General Topics

How to handle core-dumps and crash dumps

Johannes_Schoen — Fri, 11 Oct 2019 07:43:24 GMT

Hi Community,

I lately got in touch with the wonderful ccc tool and noticed, that in some environments I got notified, that core dumps or crash dumps are present.

I figured out, that the core dumps are produced by the individual Check Point processes, if anything bad happens and the are stored at /var/log/dump/usermode.

Can anyone explain what the Crash dumps mean and where they are stored?

Is there a procedure I should execute after finding a dump? Contacting TAC? Analyzing the files? Are there special tools for it?

Looking forward to your feedbacks

Best Regards
Johannes

Re: How to handle core-dumps and crash dumps

G_W_Albrecht — Fri, 11 Oct 2019 07:52:51 GMT

Learn more here:

sk92764: Core Dump Manager (CDM) for User Mode core dump files in Gaia OS

sk44186: Enable generation of kernel core dump file on Check Point Security Gateway on SecurePlatform / Gaia

Re: How to handle core-dumps and crash dumps

PhoneBoy — Fri, 11 Oct 2019 22:45:22 GMT

Generally speaking, a core file means "something crashed."
Individual processes crashing will create a core file, as will a system panic, which will generate a kernel dump.
Analyzing such files generally requires unstripped binaries/libraries, the tool gdb, and knowledge of what to look for.
If you're seeing undesired behavior along with core files, best to engage with the TAC.
Note that cpinfo actually collects these core files by default.