NAME
ccat - dump page caches
SYNOPSIS
ccat [-S] [-n pid|task] abspath|inode [outfile]
ccat -d [-S] [-n pid|task] abspath outdir
DESCRIPTION
This command dumps the page caches of a specified inode or path like
"cat" command.
-d extract a directory and its contents to outdir.
-S do not fseek() and ftruncate() to outfile in order to
create a non-sparse file.
inode a hexadecimal inode pointer.
abspath the absolute path of a file (or directory with the -d option).
outfile a file path to be written. If a file already exists there,
the command fails.
outdir a directory path to be created by the -d option.
For kernels supporting mount namespaces, the -n option may be used to
specify a task that has the target namespace:
-n pid a process PID.
-n task a hexadecimal task_struct pointer.
EXAMPLE
Dump the existing page caches of the "/var/log/messages" file:
crash> ccat /var/log/messages
Sep 16 03:13:01 host systemd: Started Session 559694 of user root.
Sep 16 03:13:01 host systemd: Starting Session 559694 of user root.
Sep 16 03:13:39 host dnsmasq-dhcp[24341]: DHCPREQUEST(virbr0) 192.168
Sep 16 03:13:39 host dnsmasq-dhcp[24341]: DHCPACK(virbr0) 192.168.122
...
Restore the size and data offset of the "messages" file as well to the
"messages.sparse" file even if some of its page caches don't exist, so
it could become sparse:
crash> ccat /var/log/messages messages.sparse
Create the non-sparse "messages.non-sparse" file:
crash> ccat -S /var/log/messages messages.non-sparse
NOTE: Redirecting to a file will also works, but it can includes crash's
messages, so specifying an outfile is recommended for restoring a file.
Extract the "/var/log" directory and its contents to the new "/tmp/log"
directory with one command:
crash> ccat -d /var/log /tmp/log