Oracle Solaris Modular Debugger Guide

Saving a Crash Dump

When the system panics, or when you enter reboot -d, the following kinds of messages appear on the console:

Sep 17 10:47:23 testsystem savecore: Decompress the crash dump with 
Sep 17 10:47:23 testsystem 'savecore -vf /var/crash/testsystem/vmdump.0'

Enter the following command:

root@testsystem # savecore -vf /var/crash/testsystem/vmdump.0
savecore: System dump time: Thu Sep 17 10:43:20 2009

savecore: saving system crash dump in /var/crash/testsystem/{unix,vmcore}.0
Constructing namelist /var/crash/testsystem/unix.0
Constructing corefile /var/crash/testsystem/vmcore.0
 1:29 100% done: 825215 of 825215 pages saved
1:30 dump decompress is done

Now you can use mdb:

root@testsystem# mdb /var/crash/testsystem/{unix,vmcore}.0
Loading modules: [ unix genunix specfs dtrace zfs scsi_vhci sd mpt px mac ldc sockfs
ip hook neti sctp arp usba stmf qlc fctl nca lofs idm logindmux ptm ufs md cpc sppp
random smbsrv nfs crypto mdesc nsctl sdbc sv rdc fcp fcip ii nsmb ]
>

You can copy the vmdump.n file to another system for analysis. You can use savecore(1M) either locally or remotely to uncompress the dump file.

Use the dumpadm(1M) command to control the particular paths of the dump device and the savecore directory.

You can use the file(1) command to quickly examine files in the directory:

$ cd /var/crash/testsystem
$ file *
bounds:         ascii text
unix.0:         ELF 64-bit MSB executable SPARCV9 Version 1, UltraSPARC3 Extensions 
Required, statically linked, not stripped, no debugging information available
vmcore.0:       SunOS 5.11 Generic 64-bit SPARC crash dump from 'testsystem'
vmdump.0:       SunOS 5.11 Generic 64-bit SPARC compressed crash dump from 'testsystem'