drgn

drgn kernel debugger

Inspect running kernel state through /proc/kcore, or a crash dump captured in a format drgn can read. Use for diagnosing hangs, verifying data structure contents, tracing reference counts, and examining queue states.

Invocation

Always use -k for live kernel debugging:

sudo drgn -k

Do NOT use -c /proc/kcore -s <path> -e vmlinux. The -e flag is parsed as inline Python, not as a vmlinux path. The -k flag handles symbol resolution automatically.

For one-shot commands:

sudo drgn -k -c 'print(prog["jiffies"])'

For multi-line scripts, materialize the script with the platform's file-editing mechanism and then invoke drgn against the resulting file in a separate shell step. Do not use a cat <<EOF heredoc to create the script: heredocs are harder for agent harnesses and hooks to inspect and can bypass edit policies.

1. Create /tmp/drgn-script.py, e.g.:

   from drgn.helpers.linux.pid import find_task
   task = find_task(prog, 1234)
   print(task.comm)
   

2. Run it:

   sudo drgn -k /tmp/drgn-script.py
   

Symbols from debuginfod under sudo

When kernel symbols come from debuginfod rather than a local kernel-debuginfo package (e.g. Fedora caching under ~/.cache/debuginfod_client), plain sudo drgn -k can fail with "missing debugging symbols" followed by an ObjectNotFoundError for a core symbol such as super_blocks. This is not a script bug: sudo's env_reset strips DEBUGINFOD_URLS, so drgn's debuginfod client never fetches vmlinux. Forward the variable:

sudo DEBUGINFOD_URLS="$DEBUGINFOD_URLS" drgn -k /tmp/drgn-script.py

The expansion uses the invoking shell's value, so an empty $DEBUGINFOD_URLS there yields DEBUGINFOD_URLS="" and reproduces the failure. Confirm echo $DEBUGINFOD_URLS is non-empty before forwarding; set it (Fedora's value appears below) when it is not.

sudo -E, or a root login whose environment already sets DEBUGINFOD_URLS, works as well. The value is distribution-specific -- https://debuginfod.fedoraproject.org/ on Fedora -- so forward the existing one rather than hardcoding a URL. The root client resolves its own cache path; no DEBUGINFOD_CACHE_PATH is needed. Before concluding the symbols are unavailable, confirm DEBUGINFOD_URLS survived into the sudo environment.