Studying a panic

The following list outlines the process for determining which kernel component caused a system panic.

1. When the system panics, write down the messages displayed and enter them in your system log book.

2. When the machine reboots, save the kernel dump that is on the dump device as shown in ``Saving the system dump memory image''.

3. Put the machine in single-user mode.

4. Run crash(1M) on the image.

5. Use the panic command in crash to find the routine in which the panic happened.

6. Note the name (symbol name) of the routine that was executing when the system panicked.

7. Quit the crash command.

8. Use strings(1) or nm(1) to determine the driver in which that routine is located. You can run a script such as the following, which uses strings.

   :
    for FILE in `find /etc/conf/pack.d -name '*.[oa]' -print`
    do
        strings $FILE | grep $1 && echo $FILE
    done
   

   If this script were installed as findpanic, you would run it with one argument that gives the name of the kernel routine:
   
   findpanic symbolname

   This script will output something like:

      routine_name
      /etc/conf/pack.d/foo/Driver.o
   

   This indicates that the foo driver may have been responsible for the system panic.