USING Q4 TO ANALYZE SYSTEM DUMP FILES   (For 10.10/20/30)
         ---------------------------------------------------------
	A crashing 10.X HP-UX system saves a snapshot of RAM in swap,
	reboots, and copies the resulting "dump" into /var/adm/crash.
	Follow this article to speedily analyze the dump and email the
	resulting ASCII text file to the HP Response Center.

	============================  STEP 1 ============================
	If /usr/contrib/bin/q4 exists, skip to step 2.
	If not, mount the INSTALL media and verify you can load it:

		# swlist -l fileset -s /<cdrom mount point> | grep Q4
	
	OS-Core.Q4    B.10.10     HP-UX Crash Dump Debugger for PA-RISC systems
                        ^^^^^
			This should match OS release!

	If q4 is not loaded, use swinstall to select and install it:

        	# swinstall -vs /<CD-ROM mount point> OS-Core.Q4

	============================  STEP 2 ============================
	If you wish to direct future dumps to a file system with more
	space, modify the following line in /etc/rc.config.d/savecore:

		SAVECORE_DIR=/var/adm/crash  <----DEFAULT destination
	
	Verify you have a dump to analyze: 

		 # ll /var/adm/crash/co*  (or your dump directory)

	You may see:
	/var/adm/crash/core.0/INDEX
	/var/adm/crash/core.0/vmunix.gz
	/var/adm/crash/core.0/core.0.1.gz
	/var/adm/crash/core.0/core.0.2.gz
	/var/adm/crash/core.0/core.0.3.gz
	/var/adm/crash/core.0/core.0.4.gz
			    ^ your suffix may vary
	
	The ../core.x/INDEX file and the /etc/shutdownlog contains the
	"panic" statement.  `touch /etc/shutdownlog` if it doesn't exist.

	If the system dump isn't in the expected location and it hasn't
	been overwritten by swapping (check swapinfo:  % USED=0), try
	to save the dump with:

		# savecore -vr <specific directory to receive the dump>

	============================  STEP 3 ============================
        THE FOLLOWING COMMANDS MUST ALL BE RUN IN THE DUMP DIRECTORY:
           NOTE: csh (c-shell) will cause errors)
    1)     # cd to the dump directory    
	   eg:  cd /var/adm/crash/core.0

	NOTE: FOR 10.20/30 DUMPS, SKIP TO STEP 5

    2) # uncompress /usr/contrib/lib/Q4Lib.tar.Z
	     (ignore the error if this was done previously)

    3) # tar -xf /usr/contrib/lib/Q4Lib.tar  
		(output goes into your current directory)

    4) # cp q4lib/sample.q4rc.pl ~/.q4rc.pl  (.pl =.p-el)
                                 ^ note the tilde
		(output goes to your login HOME directory)

    5) # /usr/contrib/bin/gunzip vmunix.gz
		(uncompresses the kernel file)

    6) If your O/S release is 10.10, type: 
           # /usr/contrib/bin/q4pxdb vmunix
		(this may complain if vmunix is already preprocessed)

	   If your O/S release is 10.20 or 10.30 type:
	   # /usr/contrib/bin/q4prep -p

    7) If in this step, you get the message:
	              "/var: file system full" 
	   move the core.<x> directory to a file system with adequate
	   available space and start at this point again.
	   (adequate = approx. 2x the sum of the core.x.y.gz files)

	   Now type:  
	   # q4 -p .  _____ Note this 'dot' at the end of the line.

    8) At the q4> prompt type:           trace event 0 > trace
           If an RCE is on the line type:    trace event 0

    9) At the prompt type:               include analyze.pl  (.p-el)

    10) At the next prompt type:         run Analyze AU >> ana.out
	NOTE: ctrl-c will interrupt

    11) At the next prompt type:         exit

	============================  STEP 4 ============================
	Generate a patch list: 
		# swlist -l product PH\*  > patch_list

	Using the CALL ID as the subject, email the patch_list, ana.out,
	whathappened.out (if created) and the trace files to: 

	    	hpcu@hpuerca.atl.hp.com

	In the future, you may wish expedite a solution by previously
	performing these steps before logging a response center call.
	Then email these files to us with the newly assigned callID as
	the subject and inform the RCE that email is enroute.
	---------------------------------------------------------------
	Latest version of q4:
	ftp://contrib:9unsupp8@hprc.external.hp.com/crash/q4.1.79.tar.Z

				   *** END *** 
		djm 5/7/96    sed 1/98
	FILENAME: /CSCinfo/9000/SWinfo/DownSystems/Dumps/using_q4 
	LAST MODIFY DATE:
Mon Jun 29 09:36:35 EDT 1998