Cisco ASA 5520 Crashinfo

[marcuslover1]

I have cisco asa 5520 firewall in production sudenly yetserday firewall was reboted and crashinfo file was genetrated(check with command show crashinfo)

But unable to undersatand the terms

I want to know below thing regarding crashinfo

1) In asa where crashinfo file stores and file name(please share commnad for checking)

2) How to copy file from device to machine

3) How to read that file(any tool any software)

[Marvin Rhoads · Accepted solution]

An ASA crashinfo file is typically saved automatically onto disk0: (internal compact flash card).

It has a system-generated name like crashinfo_. It can be transferred via any of the standard file copy mechanisms (ftp, scp etc. to a destination of your choosing.

Decode is by the Cisco TAC using their interpreter tools. (The output interpreter used to support crashinfo but I believe that's been removed as it was of limited utility in that regard.) You can read the text and sometimes get some info from that but a lot of it is more useful to developers (raw memory contents etc.)

[Ajay Saini]

Please contact Cisco TAC with following outputs from ASA:

- show crashinfo - you can simply save the session and dump the output to a notepad

-show tech

-syslogs just before the firewall crashed (if available)

-any change made on the firewall recently

[marcuslover1]

Thanks for the reply but if I want to view that file then any software available in internet which I can use ..

Anyways cisco tac is going to help me but in that case I cant learn anything from that

[Marvin Rhoads · Accepted solution]

The crashinfo file ("show crashinfo") is plain text and along with the memory register contents there is a whole long list of other information - running-configuration, interface status and counters, etc. So you can look at it in any text editor or even on the ASA console itself.

As far as learning from it directly, there is plenty to learn and use without knowing the most detailed possible level of debug information.

If you want to see some of the tools that are available (and may include some of the crashinfo data), I'd recommend to you a Cisco Live presentation like BRKSEC-3020. You can download that and any other Cisco Live presentations here with a free registration.