Managing System Crash Dump Information

This section describes tasks for managing system crash dump information.

Managing System Crash Dump Information (Task Map)

How to Display the Current Crash Dump Configuration

1. Assume the root role.

   See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Display the current crash dump configuration.

   # dumpadm
    Dump content: kernel pages
          Dump device: /dev/zvol/dsk/rpool/dump (dedicated)
   Savecore directory: /var/crash
     Savecore enabled: yes
      Save compressed: on

   The preceding example output means:

   • The dump content is kernel memory pages.

   • Kernel memory will be dumped on a dedicated dump device, /dev/zvol/dsk/rpool/dump.

   • System crash dump files will be written in the /var/crash directory.

   • Saving crash dump files is enabled.

   • Save crash dumps in compressed format.

How to Modify a Crash Dump Configuration

1. Assume the root role.

   See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Identify the current crash dump configuration.

   # dumpadm
    Dump content: kernel pages
          Dump device: /dev/zvol/dsk/rpool/dump (dedicated)
   Savecore directory: /var/crash
     Savecore enabled: yes
      Save compressed: on

   This output identifies the default dump configuration for a system running the Oracle Solaris 11 release.

3. Modify the crash dump configuration.

   #  /usr/sbin/dumpadm  [-nuy] [-c content-type] [-d dump-device] [-m mink | minm | min%]
   [-s savecore-dir] [-r root-dir] [-z on | off]

   -c content

   Specifies the type of data to dump. Use kernel to dump of all kernel memory, all to dump all of memory, or curproc, to dump kernel memory and the memory pages of the process whose thread was executing when the crash occurred. The default dump content is kernel memory.

   -d dump-device

   Specifies the device that stores dump data temporarily as the system crashes. The primary dump device is the default dump device.

   -m nnnk | nnnm | nnn%

   Specifies the minimum free disk space for saving crash dump files by creating a minfree file in the current savecore directory. This parameter can be specified in Kbytes (nnnk), Mbytes (nnnm) or file system size percentage (nnn%). The savecore command consults this file prior to writing the crash dump files. If writing the crash dump files, based on their size, would decrease the amount of free space below the minfree threshold, the dump files are not written and an error message is logged. For information about recovering from this scenario, see How to Recover From a Full Crash Dump Directory (Optional).

   -n

   Specifies that savecore should not be run when the system reboots. This dump configuration is not recommended. If system crash information is written to the swap device, and savecore is not enabled, the crash dump information is overwritten when the system begins to swap.

   -s

   Specifies an alternate directory for storing crash dump files. In Oracle Solaris 11, the default directory is /var/crash.

   -u

   Forcibly updates the kernel dump configuration based on the contents of the /etc/dumpadm.conf file.

   -y

   Modifies the dump configuration to automatically execute the savecore command upon reboot, which is the default for this dump setting.

   -z on | off

   Modifies the dump configuration to control the operation of the savecore command upon reboot. The on setting enables the saving of core file in a compressed format. The off setting automatically uncompresses the crash dump file. Because crash dump files can be extremely large and therefore require less file system space if they are saved in a compressed forma, the default is on.

Example 1-1 Modifying a Crash Dump Configuration

In this example, all of memory is dumped to the dedicated dump device, /dev/zvol/dsk/rpool/dump, and the minimum free space that must be available after the crash dump files are saved is 10% of the file system space.

# dumpadm
      Dump content: kernel pages
       Dump device: /dev/zvol/dsk/rpool/dump (dedicated)
Savecore directory: /var/crash
  Savecore enabled: yes
   Save compressed: on

# dumpadm -c all -d /dev/zvol/dsk/rpool/dump -m 10%
       Dump content: all pages
       Dump device: /dev/zvol/dsk/rpool/dump (dedicated)
Savecore directory: /var/crash (minfree = 5697105KB)
  Savecore enabled: yes
   Save compressed: on

How to Examine Crash Dump Information

1. Assume the root role.

   See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Change to the directory where the crash dump information has been saved. For example:

   # cd /var/crash

   If you are unsure of the location of the crash dump, use the dumpadm command to determine where the system has been configured to store kernel crash dump files. For example:

   # /usr/sbin/dumpadm
         Dump content: kernel pages
          Dump device: /dev/zvol/dsk/rpool/dump (dedicated)
   Savecore directory: /var/crash
     Savecore enabled: yes
      Save compressed: on

3. Examine the crash dump by using the modular debugger utility (mdb).

   # /usr/bin/mdb [-k] crashdump-file

   -k

   Specifies kernel debugging mode by assuming the file is an operating system crash dump file.

   crashdump-file

   Specifies the operating system crash dump file.

   For example:

   # /usr/bin/mdb -K vmcore.0

   Or, the command can be specified as follows:

   # /usr/bin/mdb -k 0

4. Display the system crash status, as follows:

   > ::status
      .
      .
      .
   > ::system
      .
      .
      .

   To use the ::system dcmd command when examining a kernel crash dump, the core file must be a kernel crash dump, and the -k option must have been specified when starting the mdb utility.

5. Quit the mdb utility.

   > $quit

Example 1-2 Examining Crash Dump Information

The following example shows sample output from the mdb utility, which includes system information and identifies the tunables that are set in this system's /etc/system file.

# cd /var/crash
# /usr/bin/mdb -k unix.0 
Loading modules: [ unix krtld genunix ip nfs ipc ptm ]
> ::status
debugging crash dump /dev/mem (64-bit) from ozlo
operating system: 5.10 Generic sun4v
> ::system
set ufs_ninode=0x9c40 [0t40000]
set ncsize=0x4e20 [0t20000]
set pt_cnt=0x400 [0t1024]
> $q

How to Recover From a Full Crash Dump Directory (Optional)

In this scenario, the system crashes but no room is left in the savecore directory, and you want to save some critical system crash dump information.

1. After the system reboots, log in as the root role.
2. Clear out the savecore directory, typically, /var/crash/, by removing existing crash dump files that have already been sent to your service provider.
   • Alternatively, you can manually run the savecore command to specify an alternate directory that has sufficient disk space.

     # savecore [ directory ]

How to Disable or Enable the Saving of Crash Dumps

1. Assume the root role.

   See How to Use Your Assigned Administrative Rights in Oracle Solaris 11.1 Administration: Security Services.

2. Disable or enable the saving of crash dumps on your system.

   # dumpadm -n | -y

Example 1-3 Disabling the Saving of Crash Dumps

This example illustrates how to disable the saving of crash dumps on your system.

# Dump content: all pages
       Dump device: /dev/zvol/dsk/rpool/dump (dedicated)
Savecore directory: /var/crash (minfree = 5697105KB)
  Savecore enabled: no
   Save compressed: on

Example 1-4 Enabling the Saving of Crash Dumps

This example illustrates how to enable the saving of crash dump on your system.

# dumpadm -y
      Dump content: all pages
       Dump device: /dev/zvol/dsk/rpool/dump (dedicated)
Savecore directory: /var/crash (minfree = 5697105KB)
  Savecore enabled: yes
   Save compressed: on