The following is a procedure to follow in order to prepare your crash dump files
for us to analyze, once you've gotten to a place where your system(s) is(are)
back up. This procedure assumes HP-UX version 11.X (though some of it may work
on previous versions) and that kwdb or a patched version of q4 is installed.

Step 1: Verify crash dumps are present; recreate if not.

  # ll /var/adm/crash/c*  (or your dump directory)

     You should see see files like:

        /var/adm/crash/crash.0/INDEX
        /var/adm/crash/crash.0/image.1.1.gz
        /var/adm/crash/crash.0/image.1.2.gz
        /var/adm/crash/crash.0/image.1.3.gz
        /var/adm/crash/crash.0/vmunix.gz
                             ^ Suffix increments on successive
                               dumps; we're interested in the
                               most recent one(s) if more than one.

     The INDEX file and /etc/shutdownlog contain the "panic"
     statement. Do `touch /etc/shutdownlog` if it does not exist.

     If the system dump is not in the expected location try to
     re-save the dump with:

  # savecrash -vr <specific directory to receive the dump>

     If you see "invalid dump header" it means the dump is gone.


Step 2: Verify that kwdb (preferred) or q4 is loaded.

  # swlist -l fileset | grep -i q4        -OR-
  # swlist -l fileset | grep -i KWDB


Step 3: Change directory to the crash directory.

  # cd /var/adm/crash/crash.N          (where "N" is the suffix
                                        you found in Step 1)


Step 4: (If using q4 and not kwdb) Uncompress the compressed kernel.

  # gunzip vmunix
  # . /usr/contrib/Q4/bin/set_env      (the command begins with ".")
  # /usr/contrib/Q4/bin/q4pxdb vmunix 


Step 5: Run the following commands...

  # last reboot > reboot.out
  # swlist -l product | grep -i PH > patches.out

     If you're using kwdb:

  # kwdb -q4 -p -m .    (notice the "." at the end; it's important!)
  # the prompt may initially be 'kwdb> ' or 'q4> '
  q4> set kwdb q4 on
  q4> run WhatHappened > what.out 
  q4> run WhatHappened -HANG > whath.out
  q4> run Analyze AU > ana.out 
  q4> exit 

     If you're using q4:

  # /usr/contrib/bin/q4 -p .              (note the "." at the end!)
  q4> run Analyze AU > ana.out
  q4> run WhatHappened > what.out 
  q4> run WhatHappened -HANG > whath.out
  q4> exit


Step 6: Run the crashinfo utility, if you have it. It may be in
        /usr/local/bin or /opt/sfm/tools/ or eleswhere.
        You may want to search for it with

  # find / -type f | grep crashinfo

If you have crashinfo then run it as follows:

  #  /path_to_crashinfo/crashinfo > crashinfo.out


Step 7: Send following files to support...

  1. patches.out
  2. /etc/shutdownlog
  3. /var/tombstones/ts*  (if they exist and/or if HPMC was detected)
  4. /var/adm/syslog/OLDsyslog.log  (if the dump was due to a hang)
  5. ana.out
  6. what.out (if created)
  7. whath.out (if created)
  8. reboot.out
  9. crashinfo.out (if created)