When the system panics, or when you enter reboot -d, the following kinds of messages appear on the console:
Sep 17 10:47:23 testsystem savecore: Decompress the crash dump with Sep 17 10:47:23 testsystem 'savecore -vf /var/crash/testsystem/vmdump.0'
Enter the following command:
root@testsystem # savecore -vf /var/crash/testsystem/vmdump.0 savecore: System dump time: Thu Sep 17 10:43:20 2009 savecore: saving system crash dump in /var/crash/testsystem/{unix,vmcore}.0 Constructing namelist /var/crash/testsystem/unix.0 Constructing corefile /var/crash/testsystem/vmcore.0 1:29 100% done: 825215 of 825215 pages saved 1:30 dump decompress is done |
Now you can use mdb:
root@testsystem# mdb /var/crash/testsystem/{unix,vmcore}.0 Loading modules: [ unix genunix specfs dtrace zfs scsi_vhci sd mpt px mac ldc sockfs ip hook neti sctp arp usba stmf qlc fctl nca lofs idm logindmux ptm ufs md cpc sppp random smbsrv nfs crypto mdesc nsctl sdbc sv rdc fcp fcip ii nsmb ] > |
You can copy the vmdump.n file to another system for analysis. You can use savecore(1M) either locally or remotely to uncompress the dump file.
Use the dumpadm(1M) command to control the particular paths of the dump device and the savecore directory.
You can use the file(1) command to quickly examine files in the directory:
$ cd /var/crash/testsystem $ file * bounds: ascii text unix.0: ELF 64-bit MSB executable SPARCV9 Version 1, UltraSPARC3 Extensions Required, statically linked, not stripped, no debugging information available vmcore.0: SunOS 5.11 Generic 64-bit SPARC crash dump from 'testsystem' vmdump.0: SunOS 5.11 Generic 64-bit SPARC compressed crash dump from 'testsystem' |