savecore(1M)

NAME
     savecore - save a crash vmcore dump of the operating system

SYNOPSIS
     /etc/savecore [ -f ] [ -v ] [ -d dumpdev ] dirname [ system ]

DESCRIPTION
     savecore is meant to be called by /etc/rc2.d/S48savecore.  savecore
     attempts to save the core dump of the system (assuming one was made) and
     write a reboot message in the shutdown log.  The S48savecore script will
     save all output files to dirname, which defaults to /var/adm/crash,
     unless overridden by site-specific command-line options in the file
     /etc/config/savecore.options.

     In the event of a software-detectable system crash, one of the last steps
     that the kernel performs before shutting down is to write the contents of
     system memory to the dump device.  There are several ways in which this
     information can be used to determine the cause and solution to the crash.

     The system dump device is obtained by reading the running kernel image
     and determining the device identification for the dump device. On most
     systems the default is /dev/swap.  The process of creating the dump image
     will overwrite any data on the dump device.  Thus, the dump device must
     be a raw partition that does not contain any data that needs to be
     preserved across a system crash (which is why /dev/swap is the obvious
     candidate for the dump device).  As each page of memory is written to the
     dump device, it is compressed in order to save disk space.

     On reboot, the S48savecore script initially checks the value of the
     savecore chkconfig(1M) option.  By default, this option is on for all
     systems.  If it is turned off, icrash(1M) will run against the compressed
     core image on the dump device and write reports about the system crash to
     dirname.  The compressed core image on the dump device will not be saved
     to disk.

     If the savecore chkconfig(1M) option is left on, savecore will read the
     compressed core image saved on the dump device and write it to the file
     dirname/vmcore.N.comp.  This core file can then be uncompressed using the
     uncompvm(1M) command, although most utilities designed to look at system
     core files do not require that the core file be uncompressed.  The core
     file also has a header which contains certain information about the
     system crash.  This information can be retrieved by running uncompvm(1M)
     with the -h option.

     Making sense of any saved core image requires the symbol table of the
     operating system that was running at the time of the crash.  For that
     reason, if the savecore chkconfig(1M) option is on when the S48savecore
     script runs, savecore will save the current default kernel boot file
     /unix as dirname/unix.N.  Otherwise, /unix will not be copied to dirname.
     The trailing .N in the pathname is replaced by a number stored in the
     dirname/bounds file that grows every time savecore is run in that
     directory.
     Before savecore writes out a core image, it reads a number from the file
     dirname/minfree.  If the number of free bytes on the filesystem that
     contains dirname is less than the number obtained from the minfree file,
     the core dump is not saved.  If the minfree file does not exist, savecore
     always writes out the core file (assuming that a core dump was taken).

     savecore also logs a reboot message using facility LOG_AUTH (see
     syslog(3C)).  If the system crashed as a result of a panic, savecore logs
     the panic string also.

     savecore assumes that /unix corresponds to the running system at the time
     of the crash.  If the core dump was from a system other than /unix, the
     name of that system must be supplied as system.

     The following options apply to savecore:

     -f   Ordinarily, savecore checks a magic number on the dump device
          (usually /dev/swap) to determine if a core dump was made.  This flag
          forces savecore to attempt to save the core image regardless of the
          state of this magic number.  This may be necessary since savecore
          always clears the magic number after reading it.  If a previous
          attempt to save the image failed in some manner, it is still
          possible to restart the save with this option.

     -v   Give more verbose output.

     -d   Specifies the source device to check for a dump. It should be in the
          form of dksXdYsZ where X is the controller number, Y the disk device
          and Z the the partition (example: dks0d2s1). This overrides the
          determination of the dump device from the running kernel and should
          only be used in special situations. Since no information is
          available to confirm the validity of the kernel file (normally /unix
          ) it is not copied.  It should be copied manually by the user. This
          option should never be used in the /etc/config/savecore.options
          file.

SCRIPT DIAGNOSTIC FILES
     The S48savecore script creates a number of diagnostics files:

     analysis.N   This file contains a report that has information specific to
                  the system crash.  It is created by icrash(1M) and contains
                  either an ICRASH CORE FILE REPORT, or a copy of the core
                  dump header.

VMCORE CONTENTS
     The size of the swap space is limited, and often smaller than the system
     physical memory size, so a dump is likely to be partial.  For this
     reason, the kernel takes steps to squeeze as much information as possible
     into the available space.

     The kernel uses run-length encoding to compress memory pages as it stores
     them.  This lessens the impact of pages that contain mostly zeroes.

     The kernel first stores the putbuf, which contains the system crash
     messages, followed by all memory in use by the operating system, followed
     by all memory in use by user processes, and finally all of the rest of
     free memory.  The putbuf and operating system memory contain the most
     important information and will generally fit in their entirety.

     The systune(1M) variable dump_level controls the data dumped in a system
     crash, and may have the following values:

     4 dump putbuf, kernel, buffer cache, user, and free pages
           (usual setting)

     3 dump putbuf, kernel, buffer cache, and user pages

     2 dump putbuf, kernel, and buffer cache pages

     1 dump putbuf and kernel pages

     0 dump putbuf only

DIAGNOSTICS
     warning: /unix may not have created core file
          Printed if savecore believes that the system core file does not
          correspond with the /unix operating system binary.

     savecore: /unix is not the running system
          Printed for the obvious reason.  If the system that crashed was
          /unix, use mv(1) to change its name before running savecore.  Use
          mv(1) or ln(1) to rename or produce a link to the name of the file
          of the currently running operating system binary.  This enables
          savecore to find name list information about the current state of
          the running system from the file /unix.

FILES
     /unix                          current IRIX
     /var/adm/crash                 default place to create dump files
     /var/adm/crash/bounds          number for next dump file
     /var/adm/crash/minfree         minimum filesystem free space
     /var/adm/crash/analysis.N      file created by icrash(1M) that contains
                                    information about the core dump
     /etc/config/savecore.options   site-specific command-line options

SEE ALSO
     uncompvm(1M), trcore(1M), nlist(3X), icrash(1M), chkconfig(1M).