When we refer to a "system crash", we mean a situation where the system
has detected an unrecoverable error, and has restarted itself.
The errors that cause crashes are typically detected by processor
hardware, which automatically branches to special error handling code in the
ROM monitor. The ROM monitor identifies the error, prints a message, saves
information about the failure, and restarts the system.
This document is not restricted to specific software and hardware
The information in this document was created from the devices in a
specific lab environment. All of the devices used in this document started with
a cleared (default) configuration. If your network is live, make sure that you
understand the potential impact of any command.
When the router crashes, it is extremely important to gather as much
information as possible about the crash before you manually reload or
power-cycle the router. All information about the crash, except that which has
been successfully stored in the crashinfo file, is lost after a manual reload
or power-cycle. The following outputs give some indication and information on
If you have the output of a show version,
show stacks, show
context, or show tech support command
from your Cisco device, you can use to display potential issues and fixes. To use , you must be a
This command first appeared in Cisco IOS® Software Release10.0.
The show version EXEC command displays the
configuration of the system hardware, the software version, the names and
sources of configuration files and software images, the router uptime, and
information on how the system has been restarted.
IMPORTANT: If the router is reloaded after the crash (for
example, if it has been power-cycled or the reload
command has been issued), this information will be lost, so try to collect it
This command first appeared in Cisco IOS Software Release 10.0.
The show stacks EXEC command is used to monitor the
stack usage of processes and interrupt routines. The show
stacks output is one of the most indispensable sources of
information to collect when the router crashes.
IMPORTANT: If the router is reloaded after the crash (for
example, through power-cycle or the reload command),
this information will be lost so try to collect it before reloading!
This command first appeared in Cisco IOS Software Release 10.3.
The show context EXEC command is used to display
information stored in nonvolatile RAM (NVRAM) when an exception occurs. Context
information is specific to processors and architectures, whereas software
version and uptime information are not. Context information for different
router types could therefore differ. The output displayed from the
show context command includes:
the reason for the system reboot.
signal number, code, and router uptime
all the register contents at the time of the
This command first appeared in Cisco IOS Software Release 11.2.
This command is useful in collecting general information about the router when
you report a problem. It includes:
show process cpu
show process memory
If you are connected to the console of the router at the time
of the crash, you will see something like this during the crash:
*** System received a Software forced crash ***
signal= 0x17, code= 0x24, context= 0x619978a0
PC = 0x602e59dc, Cause = 0x4020, Status Reg = 0x34008002
DCL Masked Interrupt Register = 0x000000f7
DCL Interrupt Value Register = 0x00000010
MEMD Int 6 Status Register = 0x00000000
Keep this information and the logs before it. Once the router
comes up again, do not forget to get the show stacks
If the router is set up to send logs to a syslog server, you
will see some information on what happened before the crash on the syslog
server. However, when the router is crashing, it may not be able to send the
most useful information to this syslog server. So most of the time,
syslog output is not very useful for troubleshooting
The crashinfo file is a collection of useful information
related to the current crash, stored in bootflash or flash memory. When a
router crashes due to data or stack corruption, more reload information is
needed to debug this type of crash than just the output from the normal
show stacks command.
The crashinfo is written by default to
bootflash:crashinfo on the Cisco 12000 Gigabit
Router Processor (GRP), the Cisco 7000 and 7500 Route Switch Processors (RSPs),
and the Cisco 7200 series routers. For the Cisco 7500 Versatile Interface
Processor 2 (VIP2), this file is stored by default to
where the slot_no is the VIP2
slot number. For the Cisco 7000 Route Processor (RP), the file is stored by
default to flash:crashinfo.
For more details, see Retrieving Information from the
A core dump is a full copy of the router's memory image. This
information is not necessary for troubleshooting most types of crashes, but it
is highly recommended when filing a new bug. You may need to enable some debugs
to add more information into the core dump such as debug sanity, scheduler
heapcheck process, and memory check-interval 1.
For more details, see
The router might end up in ROM monitor after a crash when its
config-register setting ends with 0. If the processor is a 68k, the prompt will
be ">". You can get the stack trace with the k
command. If the processor is a reduced instruction set computing (RISC), the
prompt will be "rommon 1>". Get the output of stack
50 or show context.
The show version and show
stacks commands provide you with output that gives you an
indication of the type of the crash that occurred, such as bus error, or
software forced crash. You can also get crash type information from the
crashinfo and show context
commands. For some later Cisco IOS Software versions, the crash
reasons are not clearly indicated (for example, you see "Signal = x" where x is
a number). Refer to Versatile
Interface Processor Crash Reason Codes to translate this number into
something meaningful. For example, "Signal = 23" translates to a software
forced crash. Follow these links to troubleshoot the specific type of crash
your router is experiencing:
If you still need assistance after following the
troubleshooting steps above, and want to open a service request with the Cisco
TAC, be sure to include the following information for troubleshooting a router
Troubleshooting performed before opening the service
show technical-support output (if
possible, in enable mode).
show log output or console
captures, if available.
file (if present, and not already included in the show
show region output (if not already
included in the show technical-support
Please attach the collected data to your service request in
non-zipped, plain text format (.txt). You can attach information to your
service request by uploading it using the
TAC Service Request tool
(registered customers only)
If you cannot access the Service Request tool, you can attach the relevant
information to your service request by sending it to email@example.com with your
case number in the subject line of your message.
Note: Please do not manually reload or power-cycle the router
before collecting the above information unless required to troubleshoot a
router crash, as this can cause important information to be lost that is needed
for determining the root cause of the problem.