我正在尝试使用crash实用程序分析ubuntu计算机上的崩溃转储，如下所示
$ sudo crash /boot/System.map-3.2.0-23-generic-pae /boot/vmlinuz-3.2.0-23-generic-pae _usr_sbin_ietd.0.crash
但它返回错误为
crash: /boot/vmlinuz-3.2.0-23-generic-pae: not a supported file format
根据崩溃实用程序语法，我已正确提供了参数
crash <system-map-file> <vmlinux-file> coredump
我在这里做错了什么？
更新:
引导目录中的vmlinuz文件似乎已被bzimage压缩
$ file vmlinuz-3.2.0-23-generic-pae
vmlinuz-3.2.0-23-generic-pae: Linux kernel x86 boot executable bzImage, version 3.2.0-23-generic-pae (buildd@palmer) #36-Ubuntu SMP Tue Apr 10 , RO-rootFS, swap_dev 0x4, Normal VGA
$
最佳答案
根据@lurker的评论
vmlinuz已压缩，可以使用以下命令解压缩(来自Extract vmlinux from vmlinuz or bzImage)
$ sudo dd if=vmlinuz-3.2.0-23-generic-pae skip=`grep -a -b -o -m 1 -P '\x1f\x8b\x08\x00' vmlinuz-3.2.0-23-generic-pae| cut -d: -f 1` bs=1 | zcat > /tmp/vmlinux
4998324+0 records in
4998324+0 records out
4998324 bytes (5.0 MB) copied, 201.859 s, 24.8 kB/s
gzip: stdin: decompression OK, trailing garbage ignored
现在出现错误
崩溃:/var/crash/_usr_sbin_ietd.0。崩溃:不支持的文件格式
我们还需要使用
apport-unpack从崩溃报告中提取核心转储文件，如下所示(from here)@ubuntu:/tmp$ sudo apport-unpack
Usage: /usr/bin/apport-unpack <report> <target directory>
@ubuntu:/tmp$ sudo apport-unpack /var/crash/_usr_sbin_ietd.0.crash /var/crash/
ERROR: Destination directory exists and is not empty.
@ubuntu:/tmp$
@ubuntu:/tmp$ sudo mkdir coretest
@ubuntu:/tmp$ sudo apport-unpack /var/crash/_usr_sbin_ietd.0.crash /tmp/coretest/
@ubuntu:/tmp$ cd coretest/
@ubuntu:/tmp/coretest$
@ubuntu:/tmp/coretest$ ls
Architecture Date ExecutablePath ProblemType ProcCwd ProcMaps Signal UserGroups
CoreDump DistroRelease ExecutableTimestamp ProcCmdline ProcEnviron ProcStatus Uname
@ubuntu:/tmp/coretest$ ls -lt
total 384
-rw-r--r-- 1 root root 4 May 29 00:13 Architecture
-rw-r--r-- 1 root root 24 May 29 00:13 Date
-rw-r--r-- 1 root root 12 May 29 00:13 DistroRelease
-rw-r--r-- 1 root root 10 May 29 00:13 ExecutableTimestamp
-rw-r--r-- 1 root root 339968 May 29 00:13 CoreDump
-rw-r--r-- 1 root root 5 May 29 00:13 ProblemType
-rw-r--r-- 1 root root 66 May 29 00:13 ProcEnviron
-rw-r--r-- 1 root root 969 May 29 00:13 ProcMaps
-rw-r--r-- 1 root root 737 May 29 00:13 ProcStatus
-rw-r--r-- 1 root root 2 May 29 00:13 Signal
-rw-r--r-- 1 root root 31 May 29 00:13 Uname
-rw-r--r-- 1 root root 14 May 29 00:13 ExecutablePath
-rw-r--r-- 1 root root 14 May 29 00:13 ProcCmdline
-rw-r--r-- 1 root root 1 May 29 00:13 ProcCwd
-rw-r--r-- 1 root root 0 May 29 00:13 UserGroups
@ubuntu:/tmp/coretest$ cd CoreDump
bash: cd: CoreDump: Not a directory
@ubuntu:/tmp/coretest$ sudo crash /tmp/vmlinux /boot/System.map-3.2.0-23-generic-pae /tmp/coretest/CoreDump
crash 6.1.6
Copyright (C) 2002-2013 Red Hat, Inc.
Copyright (C) 2004, 2005, 2006, 2010 IBM Corporation
Copyright (C) 1999-2006 Hewlett-Packard Co
Copyright (C) 2005, 2006, 2011, 2012 Fujitsu Limited
Copyright (C) 2006, 2007 VA Linux Systems Japan K.K.
Copyright (C) 2005, 2011 NEC Corporation
Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc.
Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc.
This program is free software, covered by the GNU General Public License,
and you are welcome to change it and/or distribute copies of it under
certain conditions. Enter "help copying" to see the conditions.
This program has absolutely no warranty. Enter "help warranty" for details.
GNU gdb (GDB) 7.3.1
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...
crash: /tmp/vmlinux: no debugging data available
@ubuntu:/tmp/coretest$
对于“没有可用的调试数据”，需要按照this link和此one安装一些debuginfo软件包(programname-dbg或progname-dbgsym)
在问题https://askubuntu.com/questions/197016/how-to-install-a-package-that-contains-ubuntu-kernel-debug-symbols中提到了下载内核的debuginfo软件包的步骤。
但是，添加GPG key 的步骤(如下所示)对于下载工作至关重要
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ECDCAD72428D7C01
您应该以以下方式收到消息
而不是“未更改”状态。如果在此步骤中显示“未更改”，则您将无法下载debuginfo软件包。
在这种情况下，请尝试使用http 80端口作为(here)导入GPG key
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 7F0CEB10
关于ubuntu上的崩溃转储: vmlinuz or crash file not a supported file format，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/30513520/