Crash Logging Architecture

The crash log is a persistent repository of crash event information. Each event is numbered and contains text associated with a CPU (minicore), NPU, or kernel crash. The logged events are recorded into fixed-length records and stored in /flash/crashlog2.

Whenever a crash occurs, the following crash information is stored:

  1. The event record is stored in /flash/crashlog2 file (the crash log).

  2. The associated minicore, NPU, or kernel dump file is stored in the /flash/crsh2 directory.

  3. A full core dump is stored in a user-configured directory.

Important

The crashlog2 file along with associated minicore, NPU, and kernel dumps are automatically synchronized across redundant management cards (SMC, MIO/UMIO). Full core dumps are not synchronized across management cards.

The following behaviors apply to the crash logging process.

  • When a crash event arrives on an active management card, the event record is stored in its crashlog2 file along with the minicore, NPU, or kernel dump file in /flash/crsh2. The crash event and dump file are also automatically stored in the same locations on the standby management card.

  • When a crash log entry is deleted through CLI command, it is deleted on both the active and standby management cards.

  • When a management card is added or replaced, active and standby cards automatically synchronize crash logs and dump files.

  • When a crash event is received and the crash log file is full, the oldest entry in the crash log and its related dump file will be replaced with the latest arrived event and dump file on both management cards. Information for a maximum of 120 crash events can be stored on management cards.

  • Duplicate crash events bump the count of hits in the existing record and update the new record with the old crash record. Additions to the count use the timestamp for the first time the event happened.