SAVECORE(8) Maintenance Commands and Procedures SAVECORE(8)

NAME

savecore - save a crash dump of the operating system

SYNOPSIS

/usr/bin/savecore [-L | -r] [-vd] [-f dumpfile] [directory]

DESCRIPTION

The savecore utility saves a crash dump of the kernel (assuming that
one was made) and writes a reboot message in the shutdown log. By
default, it is invoked by the dumpadm service each time the system
boots.


Depending on the dumpadm(8) configuration savecore saves either the
compressed or uncompressed crash dump. The compressed crash dump is
saved in the file directory/vmdump.n. savecore saves the
uncompressed crash dump data in the file directory/vmcore.n and the
kernel's namelist in directory/unix.n. The trailing n in the
pathnames is replaced by a number which grows every time savecore is
run in that directory.


Before writing out a crash dump, savecore reads a number from the
file directory/minfree. This is the minimum number of kilobytes that
must remain free on the file system containing directory. If after
saving the crash dump the file system containing directory would have
less free space the number of kilobytes specified in minfree, the
crash dump is not saved. if the minfree file does not exist, savecore
assumes a minfree value of 1 megabyte.


The savecore utility also logs a reboot message using facility
LOG_AUTH (see syslog(3C)). If the system crashed as a result of a
panic, savecore logs the panic string too.

OPTIONS

The following options are supported:

-d
Disregard dump header valid flag. Force savecore to
attempt to save a crash dump even if the header
information stored on the dump device indicates the
dump has already been saved.


-f dumpfile
Attempt to save a crash dump from the specified file
instead of from the system's current dump device. This
option may be useful if the information stored on the
dump device has been copied to an on-disk file by
means of the dd(8) command.


-L
Save a crash dump of the live running Solaris system,
without actually rebooting or altering the system in
any way. This option forces savecore to save a live
snapshot of the system to the dump device, and then
immediately to retrieve the data and to write it out
to a new set of crash dump files in the specified
directory. Live system crash dumps can only be
performed if you have configured your system to have a
dedicated dump device using dumpadm(8).

savecore -L does not suspend the system, so the
contents of memory continue to change while the dump
is saved. This means that live crash dumps are not
fully self-consistent.


-r
Open the dump device or file as read-only, and don't
update the dump header or do anything else that might
modify the crash dump. This option can be used to
recover a crash dump from a read-only device. This
flag cannot be used in conjunction with -L.


-v
Verbose. Enables verbose error messages from savecore.

OPERANDS

The following operands are supported:

directory
Save the crash dump files to the specified directory. If
directory is not specified, savecore saves the crash
dump files to the default savecore directory, configured
by dumpadm(8).

FILES

directory/vmdump.n


directory/vmcore.n


directory/unix.n


directory/bounds


directory/minfree


/var/crash/`uname -n`
default crash dump directory

SEE ALSO

adb(1), mdb(1), svcs(1), syslog(3C), attributes(7), smf(7), dd(8),
dumpadm(8), svcadm(8)

NOTES

The system crash dump service is managed by the service management
facility, smf(7), under the service identifier:

svc:/system/dumpadm:default


Administrative actions on this service, such as enabling, disabling,
or requesting restart, can be performed using svcadm(8). The
service's status can be queried using the svcs(1) command.


If the dump device is also being used as a swap device, you must run
savecore very soon after booting, before the swap space containing
the crash dump is overwritten by programs currently running.

February 22, 2019 SAVECORE(8)