System reports or
crashinfo files save information that helps Cisco technical support
representatives to debug problems that caused the Cisco IOS image to fail
(crash). It is necessary to quickly and reliably collect critical crash
information with high fidelity and integrity. Further, it is necessary to
collect this information and bundle it in a way that it can be associated or
identified with a specific crash occurrence.
System reports are generated in these situations:
-
In case of a switch failure—A system report is generated on the member that failed; reports are not generated on other members
in the stack.
-
In case of a switchover—System reports are generated only on high availability (HA) member switches. reports are not generated
for non-HA members.
The system does not generate reports in case of a reload.
During a process
crash, the following is collected locally from the switch:
-
Full process core
-
Tracelogs
-
IOS syslogs (not
guaranteed in case of non-active crashes)
-
System process
information
-
Bootup logs
-
Reload logs
-
Certain types of
/proc information
This information is
stored in separate files which are then archived and compressed into one
bundle. This makes it convenient to get a crash snapshot in one place, and can
be then moved off the box for analysis. This report is generated before the
switch goes down to rommon/bootloader.
Except for the full
core and tracelogs, everything else is a text file.
Crashinfo
Files
By default the
system report file will be generated and saved into the /crashinfo directory.
Ifit cannot be saved to the crashinfo partition for lack of space, then it will
be saved to the /flash directory.
To display the
files, enter the
dir crashinfo: command. The following is
sample output of a crashinfo directory:
Switch#dir crashinfo:
Directory of crashinfo:/
46553 drwx 1024 Jun 29 2015 14:52:09 +00:00 ap_crash
12 -rw- 0 Jan 1 1970 00:00:11 +00:00 koops.dat
11 -rw- 0 Mar 22 2013 07:50:30 +00:00 deleted_crash_files
13 -rwx 594269 Mar 22 2013 07:50:30 +00:00 crashinfo_platform_mgr_20130322-075017-UTC
14 -rw- 44 Sep 9 2015 09:28:47 +00:00 last_crashinfo
15 -rw- 355 Sep 9 2015 09:29:31 +00:00 last_systemreport_log
16 -rw- 105753 Mar 22 2013 07:50:47 +00:00 system-report_1_20130322-075017-UTC.gz
17 -rw- 39 Sep 9 2015 09:29:31 +00:00 last_systemreport
18 -rwx 585996 Mar 22 2013 08:01:58 +00:00 crashinfo_platform_mgr_20130322-080144-UTC
19 -rw- 105065 Mar 22 2013 08:02:15 +00:00 system-report_1_20130322-080144-UTC.gz
20 -rwx 3426209 Sep 9 2015 06:49:12 +00:00 crashinfo_iosd_20150909-064754-UTC
21 -rwx 9540376 Sep 9 2015 06:49:13 +00:00 fullcore_iosd_20150909-064754-UTC
22 -rw- 469476 Sep 9 2015 06:49:56 +00:00 system-report_1_20150909-064754-UTC.gz
23 -rwx 3425350 Sep 9 2015 09:28:47 +00:00 crashinfo_iosd_20150909-092728-UTC
24 -rwx 9535535 Sep 9 2015 09:28:47 +00:00 fullcore_iosd_20150909-092728-UTC
25 -rw- 459709 Sep 9 2015 09:29:28 +00:00 system-report_1_20150909-092728-UTC.gz
26 -rw- 0 Sep 22 2015 11:11:33 +00:00 tracelogs.J8C
50601 drwx 10240 Oct 28 2015 22:42:50 +00:00 tracelogs
248354816 bytes total (204800000 bytes free)
System reports are
located in the crashinfo directory in the following format:
system-report_[switch number]_[date]-[timestamp]-UTC.gz
After a switch
crashes, check for a system report file. The name of the most recently
generated system report file is stored in the last_systemreport file under the
crashinfo directory. The system report and crashinfo files assist TAC while
troubleshooting the issue.
The system report
generated can be further copied using TFTP, HTTP and few other options.
Switch#copy crashinfo: ?
crashinfo: Copy to crashinfo: file system
flash: Copy to flash: file system
ftp: Copy to ftp: file system
http: Copy to http: file system
https: Copy to https: file system
null: Copy to null: file system
nvram: Copy to nvram: file system
rcp: Copy to rcp: file system
running-config Update (merge with) current system configuration
scp: Copy to scp: file system
startup-config Copy to startup configuration
syslog: Copy to syslog: file system
system: Copy to system: file system
tftp: Copy to tftp: file system
tmpsys: Copy to tmpsys: file system
The general syntax
for copying onto TFTP server is as follows:
Switch#copy crashinfo: tftp:
Source filename [system-report_1_20150909-092728-UTC.gz]?
Address or name of remote host []? 1.1.1.1
Destination filename [system-report_1_20150909-092728-UTC.gz]?
The tracelogs from all members in the stack can be collected by issuing a trace archive command. This command provides time period options. The command syntax is as
follows:
Switch#request platform software trace archive ?
last Archive trace files of last x days
target Location and name for the archive file
The tracelogs stored
in crashinfo: or flash: directory from within the last 3650 days can be
collected.
Switch# request platform software trace archive last ?
<1-3650> Number of days (1-3650)
Switch#request platform software trace archive last 3650 days target ?
crashinfo: Archive file name and location
flash: Archive file name and location
Note |
It is important to
clear the system reports or trace archives from flash or crashinfo directory
once they are copied out, in order to have space available for tracelogs and
other purposes.
|