Managing System Crash Dump Information

Keep the following key points in mind when you are working with system crash information:

You must be superuser or assume an equivalent role to access and manage system crash information.
Do not disable the option of saving system crash dumps. System crash dump files provide an invaluable way to determine what is causing the system to crash.
Do not remove important system crash information until it has been sent to your customer service representative.

How to Display the Current Crash Dump Configuration

Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.
Display the current crash dump configuration.
```
# dumpadm
Dump content: kernel pages
Dump device: /dev/dsk/c0t3d0s1 (swap)
Savecore directory: /var/crash/venus
Savecore enabled: yes
```
The preceding example output means:
- The dump content is kernel memory pages.
- Kernel memory will be dumped on a swap device, /dev/dsk/c0t3d0s1. You can identify all your swap areas with the swap -l command.
- System crash dump files will be written in the /var/crash/venus directory.
- Saving crash dump files is enabled.

How to Modify a Crash Dump Configuration

Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

Identify the current crash dump configuration.

# dumpadm
      Dump content: kernel pages
       Dump device: /dev/dsk/c0t3d0s1 (swap)
Savecore directory: /var/crash/pluto
  Savecore enabled: yes

This output identifies the default dump configuration for a system running the Solaris 10 release.

Modify the crash dump configuration.
```
# dumpadm -c content -d dump-device -m nnnk | nnnm | nnn% -n -s savecore-dir
```
-c content

Specifies the type of data to dump. Use kernel to dump of all kernel memory, all to dump all of memory, or curproc, to dump kernel memory and the memory pages of the process whose thread was executing when the crash occurred. The default dump content is kernel memory.

-d dump-device

Specifies the device that stores dump data temporarily as the system crashes. The primary swap device is the default dump device.

-m nnnk | nnnm | nnn%

Specifies the minimum free disk space for saving crash dump files by creating a minfree file in the current savecore directory. This parameter can be specified in Kbytes (nnnk), Mbytes (nnnm) or file system size percentage (nnn%). The savecore command consults this file prior to writing the crash dump files. If writing the crash dump files, based on their size, would decrease the amount of free space below the minfree threshold, the dump files are not written and an error message is logged. For information on recovering from this scenario, see How to Recover From a Full Crash Dump Directory (Optional).

-n

Specifies that savecore should not be run when the system reboots. This dump configuration is not recommended. If system crash information is written to the swap device, and savecore is not enabled, the crash dump information is overwritten when the system begins to swap.

-s

Specifies an alternate directory for storing crash dump files. The default directory is /var/crash/hostname where hostname is the output of the uname -n command.

Example 17-1 Modifying a Crash Dump Configuration

In this example, all of memory is dumped to the dedicated dump device, /dev/dsk/c0t1d0s1, and the minimum free space that must be available after the crash dump files are saved is 10% of the file system space.

# dumpadm
      Dump content: kernel pages
       Dump device: /dev/dsk/c0t3d0s1 (swap)
Savecore directory: /var/crash/pluto
  Savecore enabled: yes
 # dumpadm -c all -d /dev/dsk/c0t1d0s1 -m 10%
      Dump content: all pages
       Dump device: /dev/dsk/c0t1d0s1 (dedicated)
Savecore directory: /var/crash/pluto (minfree = 77071KB)
  Savecore enabled: yes

How to Examine a Crash Dump

Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.
Examine a crash dump by using the mdb utility.
```
# /usr/bin/mdb [-k] crashdump-file
```
-k

Specifies kernel debugging mode by assuming the file is an operating system crash dump file.

crashdump-file

Specifies the operating system crash dump file.

Display crash status information.

# /usr/bin/mdb file-name
> ::status
   .
   .
   .
> ::system
   .
   .
   .

Example 17-2 Examining a Crash Dump

The following example shows sample output from the mdb utility, which includes system information and identifies the tunables that are set in this system's /etc/system file.

# /usr/bin/mdb -k unix.0 
Loading modules: [ unix krtld genunix ip nfs ipc ptm ]
> ::status
debugging crash dump /dev/mem (64-bit) from ozlo
operating system: 5.10 Generic (sun4u)
> ::system
set ufs_ninode=0x9c40 [0t40000]
set ncsize=0x4e20 [0t20000]
set pt_cnt=0x400 [0t1024]

How to Recover From a Full Crash Dump Directory (Optional)

In this scenario, the system crashes but no room is left in the savecore directory, and you want to save some critical system crash dump information.

Log in as superuser or assume an equivalent role after the system reboots.
Clear out the savecore directory, usually /var/crash/hostname, by removing existing crash dump files that have already been sent to your service provider. Or, run the savecore command and specify an alternate directory that has sufficient disk space. See the next step.
Manually run the savecore command and if necessary, specify an alternate savecore directory.
```
# savecore [ directory ]
```

How to Disable or Enable Saving Crash Dumps

Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.
Disable or enable the saving of crash dumps on your system.
```
# dumpadm -n | -y
```

Example 17-3 Disabling the Saving of Crash Dumps

This example illustrates how to disable the saving of crash dumps on your system.

# dumpadm -n
      Dump content: all pages
       Dump device: /dev/dsk/c0t1d0s1 (dedicated)
Savecore directory: /var/crash/pluto (minfree = 77071KB)
  Savecore enabled: no

Example 17-4 Enabling the Saving of Crash Dumps

This example illustrates how to enable the saving of crash dump on your system.

# dumpadm -y
      Dump content: all pages
       Dump device: /dev/dsk/c0t1d0s1 (dedicated)
Savecore directory: /var/crash/pluto (minfree = 77071KB)
  Savecore enabled: yes