path: root/usr/src/man/man8/savecore.8

'\" te
.\" Copyright (c) 2004, Sun Microsystems, Inc. All Rights Reserved.
.\" Copyright (c) 1983 Regents of the University of California. All rights reserved. The Berkeley software License Agreement specifies the terms and conditions for redistribution.
.\" Copyright 2013 Nexenta Systems, Inc.  All Rights Reserved.
.\" Copyright 2019 Joyent, Inc.
.TH SAVECORE 8 "Jun 15, 2019"
.SH NAME
savecore \- save a crash dump of the operating system
.SH SYNOPSIS
.LP
.nf
\fB/usr/bin/savecore\fR [\fB-L\fR | \fB-r\fR] [\fB-vd\fR] [\fB-k\fR \fIkeyfile\fR] [\fB-f\fR \fIdumpfile\fR] [\fIdirectory\fR]
.fi

.SH DESCRIPTION
.LP
The \fBsavecore\fR utility saves a crash dump of the kernel (assuming that one
was made) and writes a reboot message in the shutdown log. By default, it is
invoked by the \fBdumpadm\fR service each time the system boots.
.sp
.LP
Depending on the \fBdumpadm\fR(8) configuration \fBsavecore\fR saves either
the compressed or uncompressed crash dump. The compressed crash dump is saved in
the file \fIdirectory\fR\fB/vmdump.\fR\fIn\fR.
\fBsavecore\fR saves the uncompressed crash dump data in the file
\fIdirectory\fR\fB/vmcore.\fR\fIn\fR and the kernel's namelist in
\fIdirectory\fR\fB/unix.\fR\fIn.\fR The trailing \fIn\fR in the
pathnames is replaced by a number which grows every time \fBsavecore\fR is run
in that directory.
.sp
.LP
Before writing out a crash dump, \fBsavecore\fR reads a number from the file
\fIdirectory\fR\fB/minfree\fR. This is the minimum number of kilobytes that
must remain free on the file system containing \fIdirectory\fR. If after saving
the crash dump the file system containing \fIdirectory\fR would have less free
space the number of kilobytes specified in \fBminfree\fR, the crash dump is not
saved. if the \fBminfree\fR file does not exist, \fBsavecore\fR assumes a
\fBminfree\fR value of 1 megabyte.
.sp
.LP
The \fBsavecore\fR utility also logs a reboot message using facility
\fBLOG_AUTH\fR (see \fBsyslog\fR(3C)). If the system crashed as a result of a
panic, \fBsavecore\fR logs the panic string too.
.SH OPTIONS
.LP
The following options are supported:
.sp
.ne 2
.na
\fB\fB-d\fR\fR
.ad
.RS 15n
Disregard dump header valid flag. Force \fBsavecore\fR to attempt to save a
crash dump even if the header information stored on the dump device indicates
the dump has already been saved.
.RE

.sp
.ne 2
.na
\fB\fB-f\fR \fIdumpfile\fR\fR
.ad
.RS 15n
Uncompress and save a crash dump and kernel namelist data from the specified
compressed dump file.
.RE

.sp
.ne 2
.na
\fB\fB-k\fR \fIkeyfile\fR\fR
.ad
.RS 15n
Specifies that the dump should be decrypted based on the key found
in \fIkeyfile\fR. Encrypted dumps are always decrypted before being stored
in the file system, and must always be stored compressed. (That is,
decompression can only occur on a decrypted dump.) The key must match the
key specified when dump encryption is enabled via \fBdumpadm\fR.
.RE

.sp
.ne 2
.na
\fB\fB-L\fR\fR
.ad
.RS 15n
Save a crash dump of the live running system, without actually
rebooting or altering the system in any way. This option forces \fBsavecore\fR
to save a live snapshot of the system to the dump device, and then immediately
to retrieve the data and to write it out to a new set of crash dump files in
the specified directory. Live system crash dumps can only be performed if you
have configured your system to have a dedicated dump device using
\fBdumpadm\fR(8).
.sp
\fBsavecore\fR \fB-L\fR does not suspend the system, so the contents of memory
continue to change while the dump is saved. This means that live crash dumps
are not fully self-consistent.
.RE

.sp
.ne 2
.na
\fB\fB-r\fR\fR
.ad
.RS 15n
Open the dump device or file as read-only, and don't update the dump header
or do anything else that might modify the crash dump. This option can be used
to recover a crash dump from a read-only device. This flag cannot be used in
conjunction with \fB\fB-L\fR\fR.
.RE

.sp
.ne 2
.na
\fB\fB-v\fR\fR
.ad
.RS 15n
Verbose. Enables verbose error messages from \fBsavecore\fR.
.RE

.SH OPERANDS
.LP
The following operands are supported:
.sp
.ne 2
.na
\fB\fIdirectory\fR\fR
.ad
.RS 13n
Save the crash dump files to the specified directory. If \fIdirectory\fR is not
specified, \fBsavecore\fR saves the crash dump files to the default
\fBsavecore\fR \fIdirectory\fR, configured by \fBdumpadm\fR(8).
.RE

.SH FILES
.ne 2
.na
\fB\fIdirectory\fR\fB/vmdump.\fR\fIn\fR\fR
.ad
.RS 29n

.RE

.sp
.ne 2
.na
\fB\fIdirectory\fR\fB/vmcore.\fR\fIn\fR\fR
.ad
.RS 29n

.RE

.sp
.ne 2
.na
\fB\fIdirectory\fR\fB/unix.\fR\fIn\fR\fR
.ad
.RS 29n

.RE

.sp
.ne 2
.na
\fB\fIdirectory\fR\fB/bounds\fR\fR
.ad
.RS 29n

.RE

.sp
.ne 2
.na
\fB\fIdirectory\fR\fB/minfree\fR\fR
.ad
.RS 29n

.RE

.sp
.ne 2
.na
\fB\fB/var/crash/\&`uname \fR\fB-n\fR\fB\&`\fR\fR
.ad
.RS 29n
default crash dump directory
.RE

.SH SEE ALSO
.LP
.BR adb (1),
.BR mdb (1),
.BR svcs (1),
.BR syslog (3C),
.BR attributes (7),
.BR smf (7),
.BR dumpadm (8),
.BR svcadm (8)
.SH NOTES
.LP
The system crash dump service is managed by the service management facility,
\fBsmf\fR(7), under the service identifier:
.sp
.in +2
.nf
svc:/system/dumpadm:default
.fi
.in -2
.sp

.sp
.LP
Administrative actions on this service, such as enabling, disabling, or
requesting restart, can be performed using \fBsvcadm\fR(8). The service's
status can be queried using the \fBsvcs\fR(1) command.
.sp
.LP
If the dump device is also being used as a swap device, you must run
\fBsavecore\fR very soon after booting, before the swap space containing the
crash dump is overwritten by programs currently running.