WAE Core Dump File

[b.petronio]

Hi all,

I've been searching to recovering this core dump, but im not sure if it will work, and dont know if i could reboot the appliance after copy the core dump file.

Didnt found any related document too, so if any one could link me some about this, i'll apreciate it.

Best Regards,

Bruno Petrónio

****

cm1#show alarms detail support

Critical Alarms:

----------------

None

Major Alarms:

-------------

Alarm ID Module/Submodule Instance

-------------------- -------------------- --------------------

1 core_dump sysmon core

May 20 15:03:50.606 WEST, Processing Error Alarm, #000001, 1000:445001

Kernel Crash files and / or User Core files detected

/alm/maj/sysmon/core%02d/core_dump:

A user core file or kernel crash dump has been generated.

Explanation:

The System Monitor issues this to indicate that one or more

of the software modules or the kernel has generated core

files.

Action:

Access the device and check the directory /local1/core_dir,

or /local1/crash, retrieve the core file through ftp and

contact Cisco TAC.

Minor Alarms:

-------------

[dstolt]

Bruno,

The core dump is usually written to disk and is a physical file you can ftp off. Once the file is written to the disk, you will get an alarm in the CLI or GUI until the file is removed. The service that wrote the file should restart and you should be operational as soon as the file is written. If you want to see what caused this issue, the file can be decoded by the TAC, although the file name itself usually tells you what process initiated the core file.

Hope that helps,

Dan

[b.petronio]

Tks for your precious help, once more.

The extracted file, is readable from commum "applications" ? for a 1st analisys, before send it to TAC ?

Best Regards,

Bruno Petrónio

[dstolt]

No, it's not readable by any application that I know of outside of Cisco.

I usually go by what the name of the file is and compare to known issues/DDTS.

Dan

[mmoulson1]

Hi I have a customer who is getting the 'Kernel Crash files and / or User Core files detected’ error message.

Please can someone provide instructions (exact syntax please) for removing the files so it clears the error. This started after the box was powered off accidentally.

Many thanks in advance.

[Zach Seils]

The files are written in the core_dir directory.  You can delete the file(s) with the command:

delfile

Regards,

Zach

[mmoulson1]

Thanks Zach,

I don’t have access the device so have passed this on for the person onsite to try! I will let you know the outcome.

Many thanks for the prompt response.

Matt

[mmoulson1]

Hi Zach,

Please see below output is the .gz file the dump file we need to remove?

Thanks again.

Matt

Dev1#cd /local1/core_dir

Dev1#ls

core.authenticate.4.0.19.b14.cnbuild.23211.gz

[Zach Seils]

Yes, removing that file will remove the alarm.

Have you saved a copy of the file so it can be analyzed by Cisco?

Zach

[mmoulson1]

Zach, removing the file did clear the error. Unfortunately the customer has deleted it without making a copy so we are not able to submit it for analysis.

Many thanks for your support.

Matt