savecore - save a crash dump of the operating system
savecore [–dNrvV] [–D dirname] [–s secname] [–f dumpfile] [suffix] savecore –L [–v] [–D dirname] savecore –u [–dv] [–D dirname] [–f dumpfile] savecore –l [–H] [–f dumpfile] savecore –r [–v]
The savecore utility saves a crash dump of the kernel (assuming that one was made) and writes a reboot message in the system log. It is invoked by the dumpadm service each time the system boots.
savecore can be configured by dumpadm(8) to save crash dump data in either a compressed or uncompressed format. Crash dump data are divided on the dump device into sections, depending on dumpadm(8) configuration. For the compressed format, savecore saves the crash dump data in files called vmdump-<section>.N, where section is the name of the actual section; the actual number of files produced depends on the dumpadm(8) configuration and on how savecore is run. N in the pathname is replaced by a number which increments every time savecore is run to copy a crash dump from the dump device and a new crash dump is found on the dump device. The number is not incremented if some of the sections of the crash dump are already copied. The files are saved into subdirectory created under directory specified with the –D option or the crash dump directory as configured by dumpadm(8). The subdirectory is in the form of data/<uuid>, where uuid matches the unique FMA identifier of this particular panic event.
The suffix argument specifies numerical suffix. If savecore is run with the suffix argument it will attempt to uncompress all files named vmdump-<section>.N, where N is equal to the suffix argument. The suffix argument is not valid when used together with the –f option.
All compressed files can be uncompressed in a separate step using the suffix argument or individually using the –f dumpfile option. For the uncompressed format, savecore saves the crash dump data in the file directory/vmcore-<section>.N files and the kernel's namelist in directory/unix.N.
Integrity verification of vmdump-*.N files from remote system is done when extraction is performed to vmcore-*.N file. It can be done separately without the extraction using the –V option. If the verification fails, savecore marks the file as incomplete.
Before writing out a crash dump, savecore reads a number from the file directory/minfree. This is the minimum number of kilobytes that must remain free on the file system containing directory. If after saving the crash dump the file system containing directory would have less free space the number of kilobytes specified in minfree, the crash dump is not saved. if the minfree file does not exist, savecore assumes a minfree value of 1 megabyte.
The savecore utility also logs a reboot message using facility LOG_AUTH (see syslog(3C)). If the system crashed as a result of a panic, savecore logs the panic string too.
The savecore utility also produces fma(3M) event if the system rebooted after panic.
The following options are supported:
Save the crash dump files to the specified directory. If the directory option is not specified, savecore saves the crash dump files to the default savecore directory, derived from the directory configured by dumpadm(8).
Disregard dump header valid flag. Force savecore to attempt to save a crash dump even if the header information stored on the dump device indicates the dump has already been saved.
Save a crash dump from the specified file instead of from the system's current dump device. When given directory/vmdump-<section>.N, uncompress the file to vmcore-<section>. N and unix.N, where N is the same number as in the compressed name.
This option may also be useful if the information stored on the dump device has been copied to an on-disk file by means of the dd(8) command.
Omits the column headers.
Save a crash dump of the live running Solaris system, without actually rebooting or altering the system in any way. This option forces savecore to save a live snapshot of the system to the dump device, and then immediately to retrieve the data and to write it out to a new set of crash dump files in the specified directory. Live system crash dumps can only be performed if you have configured your system to have a dedicated dump device using dumpadm(8).
savecore –L does not suspend the system, so the contents of memory continue to change while the dump is saved. This means that live crash dumps are not fully self-consistent.
If no dumpfile is specified, lists sections dumped on to the dump device, but not extracted yet. If –d is specified, lists all sections dumped on to the dump devices including those already extracted.
If a dumpfile is specified with the –f option, list sections present in the dump file. The –d does not make any difference when –f is specified.
Selective extraction of sections from dump device. List of available sections can be acquired using the –l option. By default all available sections are extracted. Individual members of the list are divided by comma character.
List of possible sections names:
Kernel pages.
Pages mapped to process address space.
Pages with ZFS metadata.
Free pages or pages used for ZFS data. Only valid for crash dumps produced with the -c all setting.
Extract unix.N binary from vmcore.N.
Verify digest stored in the dump file against its contents and exit. This option has to be run together with the –f option.
Verbose. Enables verbose error messages from savecore.
The following command manually extracts only proc section from the dump device:
# savecore -v -s proc
The following command decompresses all extracted vmdump-*.3 files into corresponding vmcore-*.3 files:
# savecore 3
<directory>/data/< uuid>/vmdump.N (compressed kernel image)
<directory>/data/< uuid>/vmcore.N
<directory>/data/< uuid>/vmdump-zfs.N (compressed ZFS metadata)
<directory>/data/< uuid>/vmcore-zfs.N
<directory>/data/< uuid>/vmdump-proc.N (compressed process pages)
<directory>/data/< uuid>/vmcore-proc.N
<directory>/data/< uuid>/vmdump-other.N (compressed other pages)
<directory>/data/< uuid>/vmcore-other.N
<directory>/data/< uuid>/unix.N (kernel binary)
<directory>/N (symlink to <directory>/data/< uuid>)
<directory>/bounds
<directory>/minfree
/var/crash/ (default crash dump directory)
See attributes(7) for descriptions of the following attributes:
|
mdb(1), svcs(1), syslog(3C), fma(3M), attributes(7), smf(7), dd(8), dumpadm(8), svcadm(8)
The system crash dump service is managed by the service management facility, smf(7), under the service identifier:
svc:/system/dumpadm:default
Administrative actions on this service, such as enabling, disabling, or requesting restart, can be performed using svcadm(8). The service's status can be queried using the svcs(1) command.
If the dump device is also being used as a swap device, you must run savecore very soon after booting, before the swap space containing the crash dump is overwritten by programs currently running.
When savecore creates a file it appends the suffix .partial. After the file is completed, it is renamed without the suffix. If files are found in the dump directory with this suffix, it means that either savecore is still busy, or that it was interrupted before completely writing the file. In the former case, use ps(1) to find the PID of the running savecore process and wait for it to complete. In the latter case, remove the partial file and re-create it by running savecore –d.