Retrieve crashinfo and crashinfo_ext from Cisco devices

Cisco device after encounter an unrecoverable error, it would reboot itself to try to rectify the issue. Cisco device will store the crash information file contains extended system information that is captured quickly when the system reloads because of an error condition. The information is store on the file system under a file called “crashinfo“. The “crashinfo” file is a collection of useful information related to the current crash, stored in bootflash or flash memory.

The “crashinfo” is written by default to bootflash:crashinfo on the Cisco 12000 Gigabit Router Processor (GRP), the Cisco 7000 and 7500 Route Switch Processors (RSPs), and the Cisco 7200 series routers. For the Cisco 7500 Versatile Interface Processor 2 (VIP2), this file is stored by default to bootflash:vip2_slot_no_crashinfo where the slot_no is the VIP2 slot number. For the Cisco 7000 Route Processor (RP), the file is stored by default to flash:crashinfo.

The switch creates the “crashinfo_ext” (extended crashinfo) file when the system is failing. The information in the extended file includes additional information that can help determine the cause of the switch failure. Extended crashinfo files are kept in this directory on the flash file system:

flash:/crashinfo_ext/

The “crashinfo” file contains this information:

  • limited error message (log) and command history
  • description of the image running at the time of the crash
  • show alignment
  • malloc and free traces
  • process level stack trace
  • process level context
  • process level stack dump
  • interrupt level stack dump
  • process level info
  • process level register memory dump

Useful Cisco command for retrieving the “crashinfo” files :

dir - To display a list of files on a file system
more - To display files content
archive tar - To create a tar file, list files in a tar file, or extract the files from a tar file

Transfering the “crashinfo” file individually is tedious, so I opt to have them zipped (tar) into a single file and transferred via TFTP.

1. Tar the contents of “crashinfo” folder
2. Copy via TFTP

Step 1 : Tar the contents of “crashinfo” folder

switch#archive tar /create crashinfo.tar flash2:/crashinfo
archiving crashinfo_1 (1433 bytes)
archiving crashinfo_2 (1433 bytes)
archiving crashinfo_3 (1433 bytes)
archiving crashinfo_4 (1433 bytes)
archiving crashinfo_5 (1433 bytes)
archiving crashinfo_6 (1433 bytes)

* /create parameter create a tar file
* crashinfo.tar is the filename which you are tar-ing to
* flash2:/crashinfo is the path to the folder in the flash drive

Step 2 : Copy via TFTP

switch#copy crashinfo.tar tftp://192.168.0.100
Address or name of remote host [192.168.0.100]?
Destination filename [crashinfo.tar]?
!!
192512 bytes copied in 17.792 secs (10820 bytes/sec)

crashinfo.tar flash2:/crashinfo

References

* Retrieving Information from the Crashinfo File [LINK]
* Troubleshooting Router Crashes [LINK]

March 24, 2011 | Filed Under Network | Leave a Comment 
Your Ad Here

Next Page →

server space web hosting transition backup Tech Ed SEA 2008 Tech·Ed SEA 2008 Limited Edition T-shirt MPLS freebies Microsoft TechEd SEA 2008 IP Bgp hosting Wine Registry Tweak blogging VMware phishing DHCP contest Putty Freeware Photography router Security Ubuntu Linux Cisco Microsoft Network