KDUMP(1) | General Commands Manual | KDUMP(1)

# NAME

`kdump` — display kernel trace data

# SYNOPSIS

`kdump` | [`-dHlnRTXx`] [`-f` file] [`-m` maxdata] [`-P` program] [`-p` pid] [`-t` trstr] [`-u` label]

# DESCRIPTION

`kdump` displays the kernel trace files produced with ktrace(1) in human-readable format. By default, the file ktrace.out in the current directory is displayed, unless overridden by the `-f` option.

The options are as follows:

`-d`
  Display all numbers in decimal. By default, values are printed out in hexadecimal.
`-f` file
  Display the specified file instead of ktrace.out. Specifying ‘-’ will read from standard input.
`-H`
  Display thread identifiers.
`-l`
  Loop reading the trace file, once the end-of-file is reached, waiting for more data.
`-m` maxdata
  Display at most maxdata bytes when decoding I/O.
`-n`
  Suppress ad hoc translations. Normally `kdump` tries to decode many system calls into a more human-readable format. For example, ioctl(2) values are replaced with the macro name and errno values are replaced with the strerror(3) string. Suppressing this feature yields a more consistent output format and is easily amenable to further processing.
`-P` program
  Show output only for processes with program as their command name.
`-p` pid
  Show output only for the pid specified.
`-R`
  Display relative timestamps (time since previous entry).
`-T`
  Display absolute timestamps for each entry (seconds since the Epoch).
`-TR`
  If both options are specified, display timestamps relative to trace start.
`-t` trstr
  Select which tracepoints to display. The argument can contain one or more of the following letters. By default all trace points except for `X` are enabled.

  `c`
    trace system calls
  `i`
    trace I/O
  `n`
    trace namei translations
  `p`
    trace violation of pledge(2) restrictions
  `s`
    trace signal processing
  `S`
    trace violation of pinsyscalls(2)
  `t`
    trace various structures
  `u`
    trace user data coming from utrace(2)
  `x`
    trace argument vector in execve(2)
  `X`
    trace environment in execve(2)
  `+`
    trace the default points
`-u` label
  Display utrace(2) tracepoints having utrace(2) label label as strings with vis(3) escaping, without ktrace(2) header information.
`-X`
  Display I/O data with hexadecimal data and printable ASCII characters side by side.
`-x`
  Display I/O data in hexadecimal.

The `-t` and `-u` options are mutually exclusive; the last one specified overrides any previous ones.

# FILES

ktrace.out
  default ktrace dump file

# SEE ALSO

ktrace(1)

# HISTORY

The `kdump` command appeared in 4.3BSD-Reno.

December 15, 2023 | Debian