https://community.hpe.com/t5/operating-system-hp-ux/crash-dump/m-p/2641317#M852273 When a crash occurs, the operating system instantly stops running and passes control to the processor ROMs. The ROMs will write the contents of memory to the dump area(s) reported by lvlnboot -v. Once the dump is complete, the machine will reboot and the rc scripts will run.<BR /><BR />One of the scripts is /sbin/init.d/savecore which is configured with /etc/rc.config.d/savecore. The two parameters that need to be checked are:<BR /><BR />SAVECORE=1<BR />SAVECORE_DIR=/var/adm/crash<BR /><BR />These are the defaults and it is important to make sure /var/adm/crash has enough space for crash dumps. If not, it is a very good idea to create a separate logical volume for /var/adm/crash.<BR /><BR />Once this has been setup, and a crash occurs, the crash files will be in /var/adm/crash, a copy of vmunix as well as the crash file. During the time that the crash isa being copied by the savecore program, the panic string is stored in /etc/shutdownlog. That is where you can see the kernel's reason for the crash.<BR /><BR />Note however that typical crash messages are:<BR /><BR />data segmentation violation<BR />freeing free frag<BR />freeing free inode<BR />HPMC<BR /><BR />and so on. The first msg means that something in the thousands of lines of code made a mistake and an address is odd or does not have a 32bit boundary. mThe next two refer to things that can't happen to the filesystem but if they do, the system goes down hard. The HPMC error is almost always a hardware failure.<BR /><BR />Analysis of a crash dump is very complex, but there is a program that can help: q4 Use the man page to see if it can make sense of the crash dump for you.<BR /> Wed, 09 Jan 2002 12:45:43 GMT Bill Hassell 2002-01-09T12:45:43Z https://community.hpe.com/t5/operating-system-hp-ux/crash-dump/m-p/2641314#M852270 Where the Crash Dump in HPUX 10,20 is recorded by defect Wed, 09 Jan 2002 12:28:57 GMT https://community.hpe.com/t5/operating-system-hp-ux/crash-dump/m-p/2641314#M852270 MIGUEL CARABANO 2002-01-09T12:28:57Z https://community.hpe.com/t5/operating-system-hp-ux/crash-dump/m-p/2641315#M852271 I believe the default for dump on 10.20 is /etc/rc.config.d/savecore<BR /><BR />nancy Wed, 09 Jan 2002 12:35:07 GMT https://community.hpe.com/t5/operating-system-hp-ux/crash-dump/m-p/2641315#M852271 nancy rippey 2002-01-09T12:35:07Z https://community.hpe.com/t5/operating-system-hp-ux/crash-dump/m-p/2641316#M852272 Hi,<BR /><BR />If you are referring to where the crash dump is saved by the system upon booting up, it is stored in /var/adm/crash.<BR /><BR />For HP-UX 11.00, you will also want to check the tombstones residing in /var/tombstones.<BR /><BR />Hope this helps. Regards.<BR /><BR />Steven Sim Kok Leong<BR />Brainbench MVP for Unix Admin<BR /><A href="http://www.brainbench.com" target="_blank">http://www.brainbench.com</A> Wed, 09 Jan 2002 12:40:35 GMT https://community.hpe.com/t5/operating-system-hp-ux/crash-dump/m-p/2641316#M852272 Steven Sim Kok Leong 2002-01-09T12:40:35Z https://community.hpe.com/t5/operating-system-hp-ux/crash-dump/m-p/2641317#M852273 When a crash occurs, the operating system instantly stops running and passes control to the processor ROMs. The ROMs will write the contents of memory to the dump area(s) reported by lvlnboot -v. Once the dump is complete, the machine will reboot and the rc scripts will run.<BR /><BR />One of the scripts is /sbin/init.d/savecore which is configured with /etc/rc.config.d/savecore. The two parameters that need to be checked are:<BR /><BR />SAVECORE=1<BR />SAVECORE_DIR=/var/adm/crash<BR /><BR />These are the defaults and it is important to make sure /var/adm/crash has enough space for crash dumps. If not, it is a very good idea to create a separate logical volume for /var/adm/crash.<BR /><BR />Once this has been setup, and a crash occurs, the crash files will be in /var/adm/crash, a copy of vmunix as well as the crash file. During the time that the crash isa being copied by the savecore program, the panic string is stored in /etc/shutdownlog. That is where you can see the kernel's reason for the crash.<BR /><BR />Note however that typical crash messages are:<BR /><BR />data segmentation violation<BR />freeing free frag<BR />freeing free inode<BR />HPMC<BR /><BR />and so on. The first msg means that something in the thousands of lines of code made a mistake and an address is odd or does not have a 32bit boundary. mThe next two refer to things that can't happen to the filesystem but if they do, the system goes down hard. The HPMC error is almost always a hardware failure.<BR /><BR />Analysis of a crash dump is very complex, but there is a program that can help: q4 Use the man page to see if it can make sense of the crash dump for you.<BR /> Wed, 09 Jan 2002 12:45:43 GMT https://community.hpe.com/t5/operating-system-hp-ux/crash-dump/m-p/2641317#M852273 Bill Hassell 2002-01-09T12:45:43Z