How to identify for which service crash a core dump was generated.

Products

• VMware NSX

Issue/Introduction

This KB provides steps to identify for which service crash a core dump was generated.

Environment

VMware NSX-T
VMware NSX Data Center

Resolution

On an NSX Manager, core files can be generated in both /var/log/core/ or /image/core/.

1. There are multiple locations in NSX manager support-bundle where we can locate the core dump file.

system/ls_-althR_var :

/var/dump:
total 33M
-rw-r--r--  1 root root  33M May 14 03:09 core.nsx.disp:3.0.1715656153.1506.1007.11.gz
drwxrwx---  3 root nsx  4.0K May 14 03:09 .
drwxr-xr-x 15 root root 4.0K Feb 21  2023 ..
drwx------  2 root root  16K Oct  4  2021 lost+found

var/log/core :

total 70964
-rw-rw---- 1 svcdatamover om_vmware_support 368627712 May 23 11:14 core.nsx.disp:3.0.1715656153.1506.1007.11
drwxrwx--- 2 svcdatamover om_vmware_support         0 May 23 11:14 lost+found


2. Upload the core-dump to any linux machine (Edge here) that has gnu Debugger (GDB) enabled.

root@edge01:/etc# ll | grep -i gdb
drwxr-xr-x   2 root     root      4096 Feb 21  2023 gdb/

root@edge01:/# cd tmp
root@edge01:/tmp# ls
core.nsx.disp:3.0.1715656153.1506.1007.11  systemd-private-4b0771748ef549cd99bbea9ee429d9ad-ntp.service-R9yhZi  systemd-private-4b0771748ef549cd99bbea9ee429d9ad-systemd-logind.service-2C9a0g  systemd-private-4b0771748ef549cd99bbea9ee429d9ad-systemd-resolved.service-rOe0jj  vmware-root_822-2965448144


3. Use the 'file' command.

root@edge01:/tmp# file core.nsx.disp:3.0.1715656153.1506.1007.11
core.nsx.disp:3.0.1715656153.1506.1007.11: ELF 64-bit LSB core file, x86-64, version 1 (SYSV), SVR4-style, from '/usr/bin/appl-proxy', real uid: 1007, effective uid: 1007, real gid: 1007, effective gid: 1007, execfn: '/usr/bin/appl-proxy', platform: 'x86_64'
root@edge01:/tmp#

We can see the core file is related to Appliance Proxy Hub, APH crash.