savecore(1M)savecore(1M)NAMEsavecore - save a crash vmcore dump of the operating system
SYNOPSIS
/etc/savecore [ -f ] [ -v ] [ -d dumpdev ] dirname [ system ]
DESCRIPTIONsavecore is meant to be called by /etc/rc2.d/S48savecore. savecore
attempts to save the core dump of the system (assuming one was made) and
write a reboot message in the shutdown log. The S48savecore script will
save all output files to dirname, which defaults to /var/adm/crash,
unless overridden by site-specific command-line options in the file
/etc/config/savecore.options.
In the event of a software-detectable system crash, one of the last steps
that the kernel performs before shutting down is to write the contents of
system memory to the dump device. There are several ways in which this
information can be used to determine the cause and solution to the crash.
The system dump device is obtained by reading the running kernel image
and determining the device identification for the dump device. On most
systems the default is /dev/swap. The process of creating the dump image
will overwrite any data on the dump device. Thus, the dump device must
be a raw partition that does not contain any data that needs to be
preserved across a system crash (which is why /dev/swap is the obvious
candidate for the dump device). As each page of memory is written to the
dump device, it is compressed in order to save disk space.
On reboot, the S48savecore script initially checks the value of the
savecorechkconfig(1M) option. By default, this option is on for all
systems. If it is turned off, icrash(1M) will run against the compressed
core image on the dump device and write reports about the system crash to
dirname. The compressed core image on the dump device will not be saved
to disk.
If the savecorechkconfig(1M) option is left on, savecore will read the
compressed core image saved on the dump device and write it to the file
dirname/vmcore.N.comp. This core file can then be uncompressed using the
uncompvm(1M) command, although most utilities designed to look at system
core files do not require that the core file be uncompressed. The core
file also has a header which contains certain information about the
system crash. This information can be retrieved by running uncompvm(1M)
with the -h option.
Making sense of any saved core image requires the symbol table of the
operating system that was running at the time of the crash. For that
reason, if the savecorechkconfig(1M) option is on when the S48savecore
script runs, savecore will save the current default kernel boot file
/unix as dirname/unix.N. Otherwise, /unix will not be copied to dirname.
The trailing .N in the pathname is replaced by a number stored in the
dirname/bounds file that grows every time savecore is run in that
directory.
Page 1
savecore(1M)savecore(1M)
Before savecore writes out a core image, it reads a number from the file
dirname/minfree. If the number of free bytes on the filesystem that
contains dirname is less than the number obtained from the minfree file,
the core dump is not saved. If the minfree file does not exist, savecore
always writes out the core file (assuming that a core dump was taken).
savecore also logs a reboot message using facility LOG_AUTH (see
syslog(3C)). If the system crashed as a result of a panic, savecore logs
the panic string also.
savecore assumes that /unix corresponds to the running system at the time
of the crash. If the core dump was from a system other than /unix, the
name of that system must be supplied as system.
The following options apply to savecore:
-f Ordinarily, savecore checks a magic number on the dump device
(usually /dev/swap) to determine if a core dump was made. This flag
forces savecore to attempt to save the core image regardless of the
state of this magic number. This may be necessary since savecore
always clears the magic number after reading it. If a previous
attempt to save the image failed in some manner, it is still
possible to restart the save with this option.
-v Give more verbose output.
-d Specifies the source device to check for a dump. It should be in the
form of dksXdYsZ where X is the controller number, Y the disk device
and Z the the partition (example: dks0d2s1). This overrides the
determination of the dump device from the running kernel and should
only be used in special situations. Since no information is
available to confirm the validity of the kernel file (normally /unix
) it is not copied. It should be copied manually by the user. This
option should never be used in the /etc/config/savecore.options
file.
SCRIPT DIAGNOSTIC FILES
The S48savecore script creates a number of diagnostics files:
analysis.N This file contains a report that has information specific to
the system crash. It is created by icrash(1M) and contains
either an ICRASH CORE FILE REPORT, or a copy of the core
dump header.
VMCORE CONTENTS
The size of the swap space is limited, and often smaller than the system
physical memory size, so a dump is likely to be partial. For this
reason, the kernel takes steps to squeeze as much information as possible
into the available space.
Page 2
savecore(1M)savecore(1M)
The kernel uses run-length encoding to compress memory pages as it stores
them. This lessens the impact of pages that contain mostly zeroes.
The kernel first stores the putbuf, which contains the system crash
messages, followed by all memory in use by the operating system, followed
by all memory in use by user processes, and finally all of the rest of
free memory. The putbuf and operating system memory contain the most
important information and will generally fit in their entirety.
The systune(1M) variable dump_level controls the data dumped in a system
crash, and may have the following values:
4 dump putbuf, kernel, buffer cache, user, and free pages
(usual setting)
3 dump putbuf, kernel, buffer cache, and user pages
2 dump putbuf, kernel, and buffer cache pages
1 dump putbuf and kernel pages
0 dump putbuf only
DIAGNOSTICS
warning: /unix may not have created core file
Printed if savecore believes that the system core file does not
correspond with the /unix operating system binary.
savecore: /unix is not the running system
Printed for the obvious reason. If the system that crashed was
/unix, use mv(1) to change its name before running savecore. Use
mv(1) or ln(1) to rename or produce a link to the name of the file
of the currently running operating system binary. This enables
savecore to find name list information about the current state of
the running system from the file /unix.
FILES
/unix current IRIX
/var/adm/crash default place to create dump files
/var/adm/crash/bounds number for next dump file
/var/adm/crash/minfree minimum filesystem free space
/var/adm/crash/analysis.N file created by icrash(1M) that contains
information about the core dump
/etc/config/savecore.options site-specific command-line options
SEE ALSOuncompvm(1M), trcore(1M), nlist(3X), icrash(1M), chkconfig(1M).
Page 3
