coreadm: dumpadm: Crash Dump Defined

A core file is a point-in-time copy (snapshot) of the RAM allocated to a process.

Two types of core files:

1)Per-process core file - owned by user mode 600

2)Global core file - not created by default ; owned by root mode 600

To change the Core File Configuration use the coreadm command to modify /etc/coreadm.conf file.

 # coreadm -p pattern pid
 # coreadm -i pattern ;survives reboot
 # coreadm -e global/process/global-setid/proc-setid/log ;enable options
 # coreadm -d ;disables corefile option
 # coreadm -u ;updates
 # coreadm -g ;sets the global core file name pattern

 %p ; PID
 %u ; uid
 %g ; gid
 %f ; executable filename
 %n ; system node name uname -n
 %m ; machine hardware name = uname -m
 %t ; time in seconds since 1970,1,1.
 %d ; executable file directory/name
 %z ; zonename
 %% ; % itself

Examples:

 # coreadm -p core.%f.%p $$ ; $$ pid of the current shell
 # coreadm -p $HOME/corefiles/%n.%f.%p $$
 # coreadm -g /var/core/core.%f.%p -e global ;
 # coreadm 228 507
 # coreadm -p /var/core/usr/bin ; listing corefiles for pid
 # coreadm -G all -g /var/core/%d/%f %p %n

The dumpadm, stores a dump of memory, the /etc/dumpadm.conf stores coredump configurations. Don't edit this file. use dumpadm command instead.

The default dump area is the swap space

/var/crash/host-name/vmcore.0 - memory content

/var/crash/host-name/unix.0 - symbol table

savecore command is a utility that saves crushdump into a file on reboot.

 # dumpadm
 # dumpadm -c curproc -d swap ; Modify the dump configuration so it dumps Kernel memory pages and its
 processes to swap memory
 # dumpadm -n ; turn off savecore
 # dumpadm -u ; update kernel from /etc/dumpadm.conf
 # dumpadm -y ; turn on savecore, default
 # dumpadm -c ; specify the dump content - kernel,all or curproc
 # dumpadm -d ; specify the dump device
 # dumpadm -m minK ; set a mininum space savecore should reserve,normally,in /var/crash/host1/
 filesystem.
 # dumpadm -s savecore_dir ; specify the directory where savecore saves
 # dumpadm -r root_dir ; specify the relative root dir, default /

dumpadm Examples Tests

 # dumpadm
 Dump content: kernel pages
 Dump device: /dev/dsk/c0t0d0s1 (swap)
 Savecore directory: /var/crash/host-name
 Savecore enabled: yes

 # dumpadm -d /dev/dsk/c1t0d0s5
 Dump content: kernel pages
 Dump device: /dev/dsk/c1t0d0s5 (dedicated)
 Savecore directory: /var/crash/host-name
 Savecore enabled: yes

 # sync

 # savecore -L
 dumping to /dev/dsk/c1t0d0s5, offset 65536, content: kernel
 100% done: 11679 pages dumped, compression ratio 3.14, dump succeeded 

 System dump time: Tue Dec 5 13:21:05 2006
 Constructing namelist /var/crash/host-name/unix.0
 Constructing corefile /var/crash/host-name/vmcore.0

 100% done: 11679 of 11679 pages saved

 # cd /var/crash/host-name
 -rw-r--r-- 1 root root 1201176 Dec 5 13:21 unix.0
 -rw-r--r-- 1 root root 97640448 Dec 5 13:21 vmcore.0

 # file vmcore.0
 vmcore.0: SunOS 5.10 Generic_118822-25 64-bit SPARC crash dump from host-name

coreadm Examples Tests

 # coreadm
 global core file pattern:
 global core file content: default
 init core file pattern: core
 init core file content: default
 global core dumps: disabled
 per-process core dumps: enabled
 global setid core dumps: disabled
 per-process setid core dumps: disabled
 global core dump logging: disabled

 # mkdir /var/core

 # coreadm -e global -g /var/core/core.%f.%p

 # coreadm -e log

 # coreadm
 global core file pattern: /var/core/core.%f.%p
 global core file content: default
 init core file pattern: core
 init core file content: default
 global core dumps: enabled
 per-process core dumps: enabled
 global setid core dumps: disabled
 per-process setid core dumps: disabled
 global core dump logging: enabled

 # mkdir /var/tmp/dir

 # cd /var/tmp/dir

 # pwd
 /var/tmp/dir

  # ps
 PID TTY TIME CMD
 1094 pts/6 0:00 ps
 1056 pts/6 0:00 ksh

 # kill 8 1056

 # ls /var/core
 core.ksh.729
 core.ksh.893
 /var/core/core.ksh.729: ELF 32-bit MSB core file SPARC Version 1, from 'ksh'
 /var/core/core.ksh.893: ELF 32-bit MSB core file SPARC Version 1, from 'ksh'

 # tail /var/adm/messages
 Dec 5 13:21:08 host-name genunix: [ID 851671 kern.notice] dump succeeded
 Dec 5 13:21:29 host-name savecore: [ID 748169 auth.error] saving system crash dumpin /var/crash
 /host-name/*.0
 Dec 5 13:26:29 host-name genunix: [ID 603404 kern.notice] NOTICE: core_log: ksh[893] core dumped:
 /var/core/core.ksh.893
 Dec 5 13:27:23 host-name genunix: [ID 603404 kern.notice] NOTICE: core_log: ksh[729] core dumped:
 /var/core/core.ksh.729