System Crashes (Overview)

Keep the following key points in mind when you are working with system crash information:

• You must assume the root role to access and manage system crash information. See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

• Do not disable the option of saving system crash dumps on the system. System crash dump files provide an invaluable way to determine what is causing the system to crash.

• Do not remove important system crash information until it has been sent to your customer service representative.

System crashes can occur due to hardware malfunctions, I/O problems, and software errors. If the system crashes, it will display an error message on the console, and then write a copy of its physical memory to the dump device. The system will then reboot automatically. When the system reboots, the savecore command is executed to retrieve the data from the dump device and write the saved crash dump to your savecore directory. The saved crash dump files provide invaluable information to aid in diagnosing the problem.

The crash dump information is written in a compressed format to the vmdump.n file, where n is an integer that identifies the crash dump. Afterwards, the savecore command can be invoked on the same system or another system to expand the compressed crash dump to a pair of files that are named unix.n and vmcore.n. The directory in which the crash dump is saved upon reboot can also be configured by using the dumpadm command.

Dedicated ZFS volumes are used for swap and dump areas. After an installation, you might need to adjust the size of swap and dump devices or possibly recreate the swam and dump volumes. For instructions, see Managing Your ZFS Swap and Dump Devices in Oracle Solaris 11.1 Administration: ZFS File Systems.

System Crash Dump Files

The savecore command runs automatically after a system crash to retrieve the crash dump information from the dump device and writes a pair of files, called unix.x and vmcore.x, where x identifies the dump sequence number. Together, these files represent the saved system crash dump information.

Crash dump files are saved in a predetermined directory, which by default, is /var/crash/. In previous releases, crash dump files were overwritten when a system rebooted, unless you manually enabled the system to save the images of physical memory in a crash dump file. Now, the saving of crash dump files is enabled by default.

System crash information is managed with the dumpadm command. For more information, see Managing System Crash Dump Information With the dumpadm Command.

Saving Crash Dumps

You can examine the control structures, active tables, memory images of a live or crashed system kernel, and other information about the operation of the kernel by using the mdb utility. Using the mdb utility to its full potential requires a detailed knowledge of the kernel, and is beyond the scope of this manual. For information about using this utility, see the mdb(1) man page.

Managing System Crash Dump Information With the dumpadm Command

Use the dumpadm command to manage system crash dump information in the Oracle Solaris OS.

• The dumpadm command enables you to configure crash dumps of the operating system. The dumpadm configuration parameters include the dump content, dump device, and the directory in which the crash dump files are saved.

• Dump data is stored in a compressed format on the dump device. Kernel crash dump images can be as large as 4 Gbytes, or more. Compressing the data means faster dumping and less disk space required for the dump device.

• The saving of crash dump files is run in the background, when a dedicated dump device, not the swap area, is part of the dump configuration. This means a system that is booting does not wait for the savecore command to complete before going to the next step. On large memory systems, the system can be available before savecore completes. SeeChanges to savecore Behavior for potential issues.

• System crash dump files, generated by the savecore command, are saved by default.

• The savecore -L command enables you to get a crash dump of the live running the Oracle Solaris OS. This command is intended for troubleshooting a running system by taking a snapshot of memory during some bad state, such as a transient performance problem or service outage. If the system is up and you can still run some commands, you can execute the savecore -L command to save a snapshot of the system to the dump device, and then immediately write out the crash dump files to your savecore directory. Because the system is still running, you can only use the savecore -L command, if you have configured a dedicated dump device.

Dump configuration parameters are managed by the dumpadm command. The following table describes dumpadm's configuration parameters.

For more information, see dumpadm(1M).

How the dumpadm Command Works

During system startup, the dumpadm command is invoked by the svc:/system/dumpadm:default service to configure crash dumps parameters.

Specifically, dumpadm initializes the dump device and the dump content through the /dev/dump interface.

After the dump configuration is complete, the savecore script looks for the location of the crash dump file directory. Then, savecore is invoked to check for crash dumps and check the content of the minfree file in the crash dump directory.