GSS wants to have a way to hook vmcore analysis into abrt. abrt team is working on it.

One obstacle in this effort is that in order to process vmcore and extract useful information from it, crash tool needs corresponding debuginfo file.

In order to find/download this debuginfo, abrt needs to know the version of crashed kernel which produced vmcore.

This information is stored in RHEL6-produced vmcore. We just need a convenient way to extract it.

On Wed, 2011-04-27 at 14:23 -0400, Dave Anderson wrote:
> > But if the vmcore is an ELF kdump or a makedumpfile-generated
> > compressed dumpfile that has vmcoreinfo included (a fairly recent
> > innovation, but in RHEL6), then the strings check is totally valid,
> > because it shows the OSRELEASE= vmcoreinfo string:
> > 
> > $ strings vmcore | grep OSRELEASE=
> > OSRELEASE=2.6.32-15.el6.x86_64
> > $
> 
> Actually I'm guilty of overstating the need for needing the vmlinux 
> file *if* the vmcoreinfo OSRELEASE= string is all you need.  You could 
> conceivably do this:
> 
>   # crash -d1 vmcore | grep OSRELEASE
>                         OSRELEASE=2.6.32-132.el6.kdump.1.i686
>   # 
> 
> The -d1 flag will dump the contents of the dumpfile header,
> prior to failing because of no vmlinux argument.  And amongst
> the header contents will be the vmcoreinfo data if it exists.
> 
> It's a bit cleaner than "strings" I suppose...
> 
> But if you wanted to access the actual kernel data structure
> containing the OS release data (from which the vmcoreinfo data
> string was generated)
> 

I don't need that.

What I need it a way to find corresponding kernel debuginfo file
for RHEL6-generated vmcore. Not by hand, but with automated code.

I don't want to rely on heuristics such as "most likely current kernel
is the same one which crashed and generated thus vmcore" - this may be untrue. Similarly, I would rather not use "strings vmcore | grep OSRELEASE=" solution, since it can extract bogus OSRELEASE.

Since this information *is* recorded in RHEL6-generated vmcore, I would like a way to fetch it. I am ok with the restriction that it works only on makedumpfile-generated vmcore.

Parsing crash -d1 output is not a solution. -d1 is a debugging switch.
It may change its format over time. It may change its meaning.
It may be removed in later version, for all I know.