海运的博客

Windows用WinDbg分析蓝屏dump文件查找原因

发布时间:October 31, 2012 // 分类:Windows // No Comments

WinDbg官方下载:
http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.11.1.404.msi
http://msdl.microsoft.com/download/symbols/debuggers/dbg_amd64_6.11.1.404.msi
打开WinDbg设置Symbol File Path为:

SRV*http://msdl.microsoft.com/download/symbols

然后将dump文件拖入WinDbg窗口等待片刻即有分析结果,dump文件在C:\Windows\Minidump目录。
windbg分析windows蓝屏原因.png
输入!analyze -v查看详细分析结果:

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff8811f7ffa80, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800042d2040, address which referenced memory

Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800044ff100
 fffff8811f7ffa80 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!RtlCopyMemoryNonTemporal+40
fffff800`042d2040 4c8b0c11        mov     r9,qword ptr [rcx+rdx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  ThunderPlatfor

TRAP_FRAME:  fffff88008a5e5c0 -- (.trap 0xfffff88008a5e5c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.

STACK_COMMAND:  kb

FOLLOWUP_IP: 
L1C62x64+5534
fffff880`05e6f534 ??              ???

SYMBOL_STACK_INDEX:  c

SYMBOL_NAME:  L1C62x64+5534

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: L1C62x64

IMAGE_NAME:  L1C62x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49d2f6fd

FAILURE_BUCKET_ID:  X64_0xA_L1C62x64+5534

BUCKET_ID:  X64_0xA_L1C62x64+5534

Followup: MachineOwner
---------

1: kd> lmvm L1C62x64
start             end                 module name
fffff880`05e6a000 fffff880`05e7c000   L1C62x64 T (no symbols)           
    Loaded symbol image file: L1C62x64.sys
    Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
    Image name: L1C62x64.sys
    Timestamp:        Wed Apr 01 13:09:17 2009 (49D2F6FD)
    CheckSum:         0001660A
    ImageSize:        00012000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

可见是L1C62x64.sys的问题,查看了下是Atheros千M网卡的驱动文件,是进程ThunderPlatfor引起的系统蓝屏,先升级下网卡驱动试试,再不行就升级迅雷,郁闷ING。。。

Centos安装Flashcache使用SSD缓存

发布时间:October 28, 2012 // 分类:备份存储 // No Comments

Flashcache是Facebook技术团队开发的一个内核模块,通过在文件系统(VFS)和设备驱动之间新增一次缓存层,可以用SSD作为介质的缓存,通过将传统硬盘上的热门数据缓存到SSD上,加速服务器磁盘读写性能。
flashcache使用ssd缓存图解.jpg
Centos5.7下安装Flashcache,查看系统及内核版本:

uname -a
Linux master.www.haiyun.me 2.6.18-274.17.1.el5 #1 SMP Tue Jan 10 17:25:58 EST 2012 x86_64 x86_64 x86_64 GNU/Linux
cat /etc/issue
CentOS release 5.7 (Final)

下载安装内核源码树:

#https://www.haiyun.me
yum install rpm-build redhat-rpm-config unifdef
lftp -c "pget -n 10  http://vault.centos.org/5.7/os/SRPMS/kernel-2.6.18-274.el5.src.rpm"
rpm -i kernel-2.6.18-274.el5.src.rpm
cd /usr/src/redhat/SPECS/
rpmbuild -bp --target=$(uname -m) kernel.spec

内核模块编译准备:

cd /usr/src/redhat/BUILD/kernel-2.6.18/linux-2.6.18-274.*
make oldconfig
make prepare
make modules_prepare

下载编译Flashcache:

wget --no-check-certificate -O flashcache.tar.gz https://github.com/facebook/flashcache/tarball/master
tar zxvf flashcache.tar.gz 
cd facebook-flashcache-c4bddf6/
make install

加载Flashcache模块:

insmod /lib/modules/2.6.18-274.17.1.el5/extra/flashcache/flashcache.ko 
lsmod |grep flashcache
flashcache            112320  0 
dm_mod                102289  12 flashcache,dm_multipath,dm_raid45,dm_snapshot,dm_zero,dm_mirror,dm_log

创建Flashcache卷:

flashcache_create [-v] [-p back|thru|around] [-b block size] [-m md block size] [-s cache size] [-a associativity] cachedev ssd_devname disk_devname

挂载Flashcache卷:

mount /dev/mapper/cachedev  /home/wwwroot/

发个自定义Xshell颜色主题Color Schemes

发布时间:October 28, 2012 // 分类:Xshell // No Comments

以下内容保存为.xcs文件在下导入即可,或直接下载

#https://www.haiyun.me
<color>
[Solarized Dark]
text(bold)=839496
magenta(bold)=6c71c4
text=839496
white(bold)=fdf6e3
green=859900
red(bold)=cb4b16
green(bold)=586e75
black(bold)=073642
red=dc322f
blue=268bd2
black=002b36
blue(bold)=839496
yellow(bold)=657b83
cyan(bold)=93a1a1
yellow=b58900
magenta=dd3682
background=042028
white=eee8d5
cyan=2aa198
[Names]
count=1
name0=Solarized Dark

设置LS_COLORS,通过env查看值,如相同可略过。

#https://www.haiyun.me
alias ls='ls --color=auto'
LS_COLORS='no=00:fi=00:di=00;34:ln=00;36:pi=40;33:so=00;35:bd=40;33;01:cd=40;33;01:or=01;05;37;41:mi=01;05;37;41:ex=00;32:*.cmd=00;32:*.exe=00;32:*.com=00;32:*.btm=00;32:*.bat=00;32:*.sh=00;32:*.csh=00;32:*.tar=00;31:*.tgz=00;31:*.arj=00;31:*.taz=00;31:*.lzh=00;31:*.zip=00;31:*.z=00;31:*.Z=00;31:*.gz=00;31:*.bz2=00;31:*.bz=00;31:*.tz=00;31:*.rpm=00;31:*.cpio=00;31:*.jpg=00;35:*.gif=00;35:*.bmp=00;35:*.xbm=00;35:*.xpm=00;35:*.png=00;35:*.tif=00;35:'
export LS_COLORS

Xshell新主题效果如下:
xhell自定义颜色主题.png

Linux下NetFlow输出工具Fprobe

发布时间:October 27, 2012 // 分类:常用软件 // 4 Comments

Fprobe通过libpcap监听数据并输出NetFlow格式到分析端,极大方便网络管理及监控。
所需组件安装:

yum install libpcap-devel

Fprobe安装:

wget http://sourceforge.net/projects/fprobe/files/fprobe/1.1/fprobe-1.1.tar.bz2
tar jxvf fprobe-1.1.tar.bz2
cd fprobe-1.1/
./configure 
make
make install

Fprobe监听eth0数据并输出NetFlow到127.0.0.1:9995:

fprobe -i eth0 127.0.0.1:9995

NetFlow分析端可使用Nfsen,测试下是否有Netflow数据输出:

tcpdump -i lo -nn port 9995
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 96 bytes
14:49:33.004041 IP 127.0.0.1.57368 > 127.0.0.1.9995: UDP, length 1464
14:49:43.006334 IP 127.0.0.1.57368 > 127.0.0.1.9995: UDP, length 1464
14:49:48.003252 IP 127.0.0.1.57368 > 127.0.0.1.9995: UDP, length 264
14:49:53.002271 IP 127.0.0.1.57368 > 127.0.0.1.9995: UDP, length 744
14:49:58.002295 IP 127.0.0.1.57368 > 127.0.0.1.9995: UDP, length 456

此内容被密码保护

发布时间:October 27, 2012 // 分类:Cacti // No Comments

请输入密码访问

分类
最新文章
最近回复
  • 海运: 恩山有很多。
  • swsend: 大佬可以分享一下固件吗,谢谢。
  • Jimmy: 方法一 nghtp3步骤需要改成如下才能编译成功: git clone https://git...
  • 海运: 地址格式和udpxy一样,udpxy和msd_lite能用这个就能用。
  • 1: 怎么用 编译后的程序在家里路由器内任意一台设备上运行就可以吗?比如笔记本电脑 m参数是笔记本的...
  • 孤狼: ups_status_set: seems that UPS [BK650M2-CH] is ...
  • 孤狼: 擦。。。。apcupsd会失联 nut在冲到到100的时候会ONBATT进入关机状态,我想想办...
  • 海运: 网络,找到相应的url编辑重发请求,firefox有此功能,其它未知。
  • knetxp: 用浏览器F12网络拦截或监听后编辑重发请求,修改url中的set为set_super,将POS...
  • Albert: 啊啊啊啊啊啊啊啊啊 我太激动了,终于好了英文区搜索了半天,翻遍了 pve 论坛没找到好方法,博...