Powered By Blogger

Wednesday, January 19, 2011

Crash Dump & Core Dump


Crash-dump : When an operating system has a fatal error, it generates a crash dump

Core-dump : When a process has a fatal error, it generates a core file.

Crash Dump Operation :
If a fatal operating system error occurs, the operating system prints a message to the console, describing the error. The operating system then generates a crash dump by writing some of the contents of the physical memory to a predetermined dump device, which must be a local disk slice. You can configure the dump device by using the dumpadm command. After the operating system has written the crash dump to the dump device, the system reboots. The crash dump is saved for future analysis to help determine the cause of the fatal error.


Command dumpadm  To display current crash dump configuration:
[root@testserver:/var/crash]# dumpadm
Dump content: kernel pages ---- [kernal memory pages]
Dump device: /dev/dsk/c8t0d0s7 (dedicated) ---[ Kernel memory will be dumped to dedicated as per our configuration]
Savecore directory: /var/crash/testserver --- [Crash dump generate two files(unix.x & vmcore.x) will be written in savecore directory]
Savecore enabled: yes


How to enable & disable saving crash dumpadm:

dumpadm -n -- [disable saving crash dumpadm]
0[root@testserver(global):/var/crash]# dumpadm
Dump content: kernel pages
Dump device: /dev/dsk/c8t0d0s7 (dedicated)
Savecore directory: /var/crash/testserver
Savecore enabled: no

dumpadm -y -- enable saving crash dumpadm
0[root@testserver(global):/var/crash]# dumpadm
Dump content: kernel pages
Dump device: /dev/dsk/c8t0d0s7 (dedicated)
Savecore directory: /var/crash/testserver
Savecore enabled: yes

How to modify the dump content

specify the 3 type of data to dump :
1. kernel --> To dump of all kernel memory
2. All --> To dump all of memory
3. curproc --> To dump kernel memory and current pages of the process whose thread was executing when the crash occurred

[root@testserver-zfs-test(global):~]# dumpadm -c all
Dump content: all pages
Dump device: /dev/dsk/c0t0d0s1 (swap)
Savecore directory: /dump
Savecore enabled: yes

[root@testserver:~]# dumpadm -c curproc
Dump content: kernel and current process pages
Dump device: /dev/dsk/c0t0d0s1 (swap)
Savecore directory: /dump
Savecore enabled: yes

[root@testserver:~]# dumpadm -c kernel
Dump content: kernel pages
Dump device: /dev/dsk/c0t0d0s1 (swap)
Savecore directory: /dump
Savecore enabled: yes

How to modify the dump device:

dumpadm -d /dev/dsk/c0t1d0s1
dumpadm -d swap
0[root@testserver(global):/var/crash]# dumpadm -d swap
Dump content: kernel pages
Dump device: /dev/dsk/c0t0d0s1 (swap)
Savecore directory: /var/crash/testserver
Savecore enabled: yes

0[root@testserver(global):/var/crash]# dumpadm -d /dev/dsk/c8t0d0s7
Dump content: kernel pages
Dump device: /dev/dsk/c8t0d0s7 (dedicated)
Savecore directory: /var/crash/testserver
Savecore enabled: yes

How to Examine a Crash Dump

/usr/bin/mdb [-k] crashdump-file
-k Specifies kernel debugging mode by assuming the file is an operating system crash dump file.


Core Dump Operation:

When a process terminates abnormally, it typically produces a core file. You can use the coreadm command to specify the name or location of core files produced by abnormally terminating processes.