savecore(1M) savecore(1M)
NAME
savecore - save a crash vmcore dump of the operating system
SYNOPSIS
/etc/savecore [ -f ] [ -v ] dirname [ system ]
DESCRIPTION
savecore is meant to be called by /etc/rc2.d/S48savecore. savecore
attempts to save the core dump of the system (assuming one was made) and
write a reboot message in the shutdown log. The S48savecore script will
save all output files to dirname, which defaults to /var/adm/crash,
unless overridden by site-specific command-line options in the file
/etc/config/savecore.options.
In the event of a software-detectable system crash, one of the last steps
that the kernel performs before shutting down is to write the contents of
system memory to the dump device. There are several ways in which this
information can be used to determine the cause and solution to the crash.
The dump device normally defaults to /dev/swap. The process of creating
the dump image will overwrite any data on the dump device. Thus, the
dump device must be a raw partition that does not contain any data that
needs to be preserved across a system crash (which is why /dev/swap is
the obvious candidate for the dump device). As each page of memory is
written to the dump device, it is compressed in order to save disk space.
On reboot, the S48savecore script initially checks the value of the
savecore chkconfig(1M) option. By default, this option is on for all
systems. If it is turned off, icrash(1M) and fru(1M) (if installed) will
run against the compressed core image on the dump device and write
reports about the system crash to dirname. The compressed core image on
the dump device will not be saved to disk.
If the savecore chkconfig(1M) option is left on, savecore will read the
compressed core image saved on the dump device and write it to the file
dirname/vmcore.N.comp. This core file can then be uncompressed using the
uncompvm(1M) command, although most utilities designed to look at system
core files do not require that the core file be uncompressed. The core
file also has a header which contains certain information about the
system crash. This information can be retreived by running uncompvm(1M)
with the -h option.
Making sense of any saved core image requires the symbol table of the
operating system that was running at the time of the crash. For that
reason, if the savecore chkconfig(1M) option is on when the S48savecore
script runs, savecore will save the current default kernel boot file
/unix as dirname/unix.N. Otherwise, /unix will not be copied to dirname.
The trailing .N in the pathname is replaced by a number stored in the
dirname/bounds file that grows every time savecore is run in that
directory.
Page 1
savecore(1M) savecore(1M)
Before savecore writes out a core image, it reads a number from the file
dirname/minfree. If the number of free bytes on the filesystem that
contains dirname is less than the number obtained from the minfree file,
the core dump is not saved. If the minfree file does not exist, savecore
always writes out the core file (assuming that a core dump was taken).
savecore also logs a reboot message using facility LOG_AUTH (see
syslog(3C)). If the system crashed as a result of a panic, savecore logs
the panic string also.
savecore assumes that /unix corresponds to the running system at the time
of the crash. If the core dump was from a system other than /unix, the
name of that system must be supplied as system.
The following options apply to savecore:
-f Ordinarily, savecore checks a magic number on the dump device
(usually /dev/swap) to determine if a core dump was made. This flag
forces savecore to attempt to save the core image regardless of the
state of this magic number. This may be necessary since savecore
always clears the magic number after reading it. If a previous
attempt to save the image failed in some manner, it is still
possible to restart the save with this option.
-v Give more verbose output.
SCRIPT DIAGNOSTIC FILES
The S48savecore script creates a number of diagnostics files:
analysis.N This file contains a report that has information specific to
the system crash. It is created by icrash(1M) and contains
either an ICRASH CORE FILE REPORT, or a copy of the core
dump header.
fru.N This file is created by fru(1M) if it is installed on the
system. fru(1M) runs against the system core image to
determine if a hardware failure occurred. Note that fru(1M)
is not available for all platforms.
VMCORE CONTENTS
The size of the swap space is limited, and often smaller than the system
physical memory size, so a dump is likely to be partial. For this
reason, the kernel takes steps to squeeze as much information as possible
into the available space.
The kernel uses run-length encoding to compress memory pages as it stores
them. This lessens the impact of pages that contain mostly zeroes.
The kernel first stores the putbuf, which contains the system crash
messages, followed by all memory in use by the operating system, followed
by all memory in use by user processes, and finally all of the rest of
free memory. The putbuf and operating system memory contain the most
Page 2
savecore(1M) savecore(1M)
important information and will generally fit in their entirety.
The systune(1M) variable dump_level controls the data dumped in a system
crash, and may have the following values:
3 dump putbuf, kernel, user, and free pages (usual setting)
2 dump putbuf, kernel, and user pages
1 dump putbuf and kernel pages
0 dump putbuf only
DIAGNOSTICS
warning: /unix may not have created core file
Printed if savecore believes that the system core file does not
correspond with the /unix operating system binary.
savecore: /unix is not the running system
Printed for the obvious reason. If the system that crashed was
/unix, use mv(1) to change its name before running savecore. Use
mv(1) or ln(1) to rename or produce a link to the name of the file
of the currently running operating system binary. This enables
savecore to find name list information about the current state of
the running system from the file /unix.
FILES
/unix current IRIX
/var/adm/crash default place to create dump files
/var/adm/crash/bounds number for next dump file
/var/adm/crash/minfree minimum filesystem free space
/var/adm/crash/analysis.N file created by icrash(1M) that contains
information about the core dump
/var/adm/crash/fru.N hardware analysis file created by fru(1M)
(optional product)
/etc/config/savecore.options site-specific command-line options
SEE ALSO
uncompvm(1M), nlist(3X), icrash(1M), fru(1M), chkconfig(1M).
Page 3