Solved: How to handle core-dumps and crash dumps

Johannes_Schoen · ‎2019-10-11

Hi Community,

I lately got in touch with the wonderful ccc tool and noticed, that in some environments I got notified, that core dumps or crash dumps are present.

I figured out, that the core dumps are produced by the individual Check Point processes, if anything bad happens and the are stored at /var/log/dump/usermode.

Can anyone explain what the Crash dumps mean and where they are stored?

Is there a procedure I should execute after finding a dump? Contacting TAC? Analyzing the files? Are there special tools for it?

Looking forward to your feedbacks

Best Regards
Johannes

PhoneBoy · ‎2019-10-11

Generally speaking, a core file means "something crashed."
Individual processes crashing will create a core file, as will a system panic, which will generate a kernel dump.
Analyzing such files generally requires unstripped binaries/libraries, the tool gdb, and knowledge of what to look for.
If you're seeing undesired behavior along with core files, best to engage with the TAC.
Note that cpinfo actually collects these core files by default.

View solution in original post

G_W_Albrecht · ‎2019-10-11

Learn more here:

sk92764: Core Dump Manager (CDM) for User Mode core dump files in Gaia OS

sk44186: Enable generation of kernel core dump file on Check Point Security Gateway on SecurePlatfor...

CCSP - CCSE / CCTE / CTPS / CCME / CCSM Elite / SMB Specialist

PhoneBoy · ‎2019-10-11

Generally speaking, a core file means "something crashed."
Individual processes crashing will create a core file, as will a system panic, which will generate a kernel dump.
Analyzing such files generally requires unstripped binaries/libraries, the tool gdb, and knowledge of what to look for.
If you're seeing undesired behavior along with core files, best to engage with the TAC.
Note that cpinfo actually collects these core files by default.

Are you a member of CheckMates?

How to handle core-dumps and crash dumps