SAVECORE(8) Maintenance Commands and Procedures SAVECORE(8)

NAME

savecore - save a crash dump of the operating system

SYNOPSIS

/usr/bin/savecore [-L | -r] [-vd] [-k keyfile] [-f dumpfile] [directory]

DESCRIPTION

The savecore utility saves a crash dump of the kernel (assuming that one
was made) and writes a reboot message in the shutdown log. By default, it
is invoked by the dumpadm service each time the system boots.


Depending on the dumpadm(8) configuration savecore saves either the
compressed or uncompressed crash dump. The compressed crash dump is saved
in the file directory/vmdump.n. savecore saves the uncompressed crash
dump data in the file directory/vmcore.n and the kernel's namelist in
directory/unix.n. The trailing n in the pathnames is replaced by a number
which grows every time savecore is run in that directory.


Before writing out a crash dump, savecore reads a number from the file
directory/minfree. This is the minimum number of kilobytes that must
remain free on the file system containing directory. If after saving the
crash dump the file system containing directory would have less free
space the number of kilobytes specified in minfree, the crash dump is not
saved. if the minfree file does not exist, savecore assumes a minfree
value of 1 megabyte.


The savecore utility also logs a reboot message using facility LOG_AUTH
(see syslog(3C)). If the system crashed as a result of a panic, savecore
logs the panic string too.

OPTIONS

The following options are supported:

-d
Disregard dump header valid flag. Force savecore to
attempt to save a crash dump even if the header
information stored on the dump device indicates the dump
has already been saved.


-f dumpfile
Uncompress and save a crash dump and kernel namelist data
from the specified compressed dump file.


-k keyfile
Specifies that the dump should be decrypted based on the
key found in keyfile. Encrypted dumps are always decrypted
before being stored in the file system, and must always be
stored compressed. (That is, decompression can only occur
on a decrypted dump.) The key must match the key specified
when dump encryption is enabled via dumpadm.


-L
Save a crash dump of the live running system, without
actually rebooting or altering the system in any way. This
option forces savecore to save a live snapshot of the
system to the dump device, and then immediately to
retrieve the data and to write it out to a new set of
crash dump files in the specified directory. Live system
crash dumps can only be performed if you have configured
your system to have a dedicated dump device using
dumpadm(8).

savecore -L does not suspend the system, so the contents
of memory continue to change while the dump is saved. This
means that live crash dumps are not fully self-consistent.


-r
Open the dump device or file as read-only, and don't
update the dump header or do anything else that might
modify the crash dump. This option can be used to recover
a crash dump from a read-only device. This flag cannot be
used in conjunction with -L.


-v
Verbose. Enables verbose error messages from savecore.

OPERANDS

The following operands are supported:

directory
Save the crash dump files to the specified directory. If
directory is not specified, savecore saves the crash dump
files to the default savecore directory, configured by
dumpadm(8).

FILES

directory/vmdump.n


directory/vmcore.n


directory/unix.n


directory/bounds


directory/minfree


/var/crash/`uname -n`
default crash dump directory

SEE ALSO

adb(1), mdb(1), svcs(1), syslog(3C), attributes(7), smf(7), dumpadm(8),
svcadm(8)

NOTES

The system crash dump service is managed by the service management
facility, smf(7), under the service identifier:

svc:/system/dumpadm:default


Administrative actions on this service, such as enabling, disabling, or
requesting restart, can be performed using svcadm(8). The service's
status can be queried using the svcs(1) command.


If the dump device is also being used as a swap device, you must run
savecore very soon after booting, before the swap space containing the
crash dump is overwritten by programs currently running.

June 15, 2019 SAVECORE(8)