Gopi Desaboyina Solaris Blogs

Just another weblog

Solaris crash dumps and savecore

Whenever system panics for any reasons like NULL pointer exceptions,buffer overflows,unrecoverable ECC mem errors it would start dumping all memory pages to dump device for later analyze. It syncs the filesystem buffers and reboot the system. while dumping kernel memory pages to dump device, it also flags the pages which were written to dump device. so that later it can save those pages to file system for analyzing them. During reboot, system always checks for these flags and if there are any flagged pages it writes them to savecore directory which can be shown using dumpadm command. if it’s successful you’ll see vmcore.n,unix.n & bounds files in savecore dir. During reboot it always happens to me that savecore throws error saying there is not enough space. don’t panic now, even after reboot you can save those pages to filesystem using savecore command.Just point your savecore dir to place where you’ve sufficient space and then issue savecore command. you should be able to get all dumps and analyze or send them to sun.

sometimes, if you accidentally removed those crashdumps, don’t panic again. you can dump from dump device again using savecore -d # This would tell, even if they were saved once, you can save them again by ignoring those flags.
if crashdumps already written to filesystem. if you simply use savecore without -d you won’t get anything due to flags set after those pages saved.

If you want to take crash dump of running system, you can use savecore -L. few things you should note before doing this. you should configure new dedicated dump device[ which is not same as your swap device] using dumpadm -d . Good thing about savecore -L is it won’t reboot the system.


June 4, 2009 - Posted by | Solaris |

No comments yet.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: