Solaris 10 crash dumps

crash dumps - content of memory

kernel - kernel
current activities - curproc
other

The default dump area is the swap space

/var/crash/host1/vmcore.0 - memory content
/var/crash/host1/unix.0 - symbol table

savecore - a utility that saves crushdump into a file on reboot.

Commands:
#dumpadm
#dumpadm -c curproc -d swap

#dumpadm -n ; turn off savecore
#dumpadm -u ; update kernel from /etc/dumpadm.conf
#dumpadm -y ; turn on savecore, default
#dumpadm -c ; specify the dump content - kernel,all or curproc
#dumpadm -d ; specify the dump device

#dumpadm -m minK ; set a mininum space savecore should reserve,normally,
in /var/crash/host1/ filesystem.

#dumpadm -s savecore_dir ; specify the directory where savecore saves
#dumpadm -r root_dir ; specify the relative root dir, default /

/etc/dumpadm.conf stores coredump configurations. don't edit this file.
use dumpadm instead.

Task
---------------------------------------------

ksh:gulf1# dumpadm
Dump content: kernel pages
Dump device: /dev/dsk/c0t0d0s1 (swap)
Savecore directory: /var/crash/gulf1
Savecore enabled: yes

ksh:gulf1# dumpadm -d /dev/dsk/c1t0d0s5
Dump content: kernel pages
Dump device: /dev/dsk/c1t0d0s5 (dedicated)
Savecore directory: /var/crash/gulf1
Savecore enabled: yes

ksh:gulf1# sync

ksh:gulf1# savecore -L
dumping to /dev/dsk/c1t0d0s5, offset 65536, content: kernel
100% done: 11679 pages dumped, compression ratio 3.14, dump succeeded

System dump time: Tue Dec 5 13:21:05 2006
Constructing namelist /var/crash/gulf1/unix.0
Constructing corefile /var/crash/gulf1/vmcore.0
100% done: 11679 of 11679 pages saved

ksh:gulf1# ksh:gulf1# cd /var/crash/gulf1
-rw-r--r-- 1 root root 1201176 Dec 5 13:21 unix.0
-rw-r--r-- 1 root root 97640448 Dec 5 13:21 vmcore.0
ksh:gulf1# file vmcore.0
vmcore.0: SunOS 5.10 Generic_118822-25 64-bit SPARC crash dump from ''
---------------------------------------------





==========
Core Files
==========

A core file is a point-in-time copy (snapshot) of the RAM allocated to
a process.

Two types of core files:
1)Per-process core file ; owned by user mode 600
2)Glboal core file - not created by default ; owned by root mode 600


#coreadm
#coreadm -g /var/core/core.%f.%p -e global

/etc/coreadm.conf

ksh:gulf1# coreadm
global core file pattern:
global core file content: default
init core file pattern: core
init core file content: default
global core dumps: disabled
per-process core dumps: enabled
global setid core dumps: disabled ;security options
per-process setid core dumps: disabled
global core dump logging: disabled



Changing Core File Configuration

use command coreadm to modify /etc/coreadm.conf file.

coreadm -p pattern pid
coreadm -i pattern ;survives reboot
coreadm -e global/process/global-setid/proc-setid/log ;enable options
coreadm -d ;disables corefile option
coreadm -u ;updates
coreadm -g ;sets the global core file name pattern.

%p ; PID
%u ; uid
%g ; gid
%f ; executable filename
%n ; system node name uname -n
%m ; machine hardware name = uname -m
%t ; time in seconds since 1970,1,1.
%d ; executable file directory/name
%z ; zonename
%% ; % itself

Examples:

coreadm -p core.%f.%p $$ ; $$ pid of the current shell
coreadm -p $HOME/corefiles/%n.%f.%p $$
coreadm -g /var/core/core.%f.%p -e global ;

coreadm 228 507
coreadm -p /var/core/usr/bin ; listing corefiles for pid
coreadm -G all -g /var/core/%d/%f %p %n



Tasks
---------------------------------------------

coreadm

ksh:gulf1# coreadm
global core file pattern:
global core file content: default
init core file pattern: core
init core file content: default
global core dumps: disabled
per-process core dumps: enabled
global setid core dumps: disabled
per-process setid core dumps: disabled
global core dump logging: disabled

ksh:gulf1# mkdir /var/core

ksh:gulf1# coreadm -e global -g /var/core/core.%f.%p

ksh:gulf1# coreadm -e log

ksh:gulf1# coreadm
global core file pattern: /var/core/core.%f.%p
global core file content: default
init core file pattern: core
init core file content: default
global core dumps: enabled
per-process core dumps: enabled
global setid core dumps: disabled
per-process setid core dumps: disabled
global core dump logging: enabled

ksh:gulf1# mkdir /var/tmp/dir
ksh:gulf1# cd /var/tmp/dir
ksh:gulf1# pwd
/var/tmp/dir

ksh:gulf1# ps
PID TTY TIME CMD
1094 pts/6 0:00 ps
1056 pts/6 0:00 ksh

ksh:gulf1# kill 8 1056

ksh:gulf1# ls /var/core
core.ksh.729
core.ksh.893
/var/core/core.ksh.729: ELF 32-bit MSB core file SPARC Version 1, from 'ksh'
/var/core/core.ksh.893: ELF 32-bit MSB core file SPARC Version 1, from 'ksh'


#tail /var/adm/messages
Dec 5 13:21:08 gulf1 genunix: [ID 851671 kern.notice] dump succeeded
Dec 5 13:21:29 gulf1 savecore: [ID 748169 auth.error] saving system crash dump
in /var/crash/gulf1/*.0
Dec 5 13:26:29 gulf1 genunix: [ID 603404 kern.notice] NOTICE: core_log: ksh[893
] core dumped: /var/core/core.ksh.893
Dec 5 13:27:23 gulf1 genunix: [ID 603404 kern.notice] NOTICE: core_log: ksh[729
] core dumped: /var/core/core.ksh.729