System Dump file

[Tommy Wang]

I have an experience that the system show a system crash warning message as system booting.
Is there any general instruction teach me how to trace to system crash cause by using the dump file? And what is the use of these dump file?
Any help will be highly appreciated.

[rajsri]

Hi
if you want to know , what dump is and used for what ? and how to trace system crash .
pls refer to attachment.

[Emmanuel Eyer]

Isnt'it just a message telling your dump device is too small for your physical memory, not allowing a full dump? The recommended (yup, HP official way of thinking!) dump configuration is following.

Get (or buy) an extra disk, sufficiently large for your system memory (say 9 GB is OK if you have a 8 G RAM). Install the disk, get its hardware path. Say it is HWP. Edit your system file, replacing the line "dump default" or "dump lvol" by "dump HWP". Regenerate your kernel. Reboot. Now your dump device is no longer your primary swap, but a separate disk. Don't even need to activate savecore (or savecrash in v11), as the dump device will not be used for anything else. Using a separate disk is preferred to use dum lvols, since dump lvols are pretty uggly to handle (must be in vg00, within first 2 GB....) You can even remove dump definition from your LVM structures (e.g. lvrmboot -d lvol2 ; lvlnboot -R).

Sure, it makes you use an extra disk, but what's the price of a HDD (even an HP one) compared to your system, eh?

Hope it helps, Emmanuel

[Bill Hassell]

A dump file will be created when your system crashes (seems to reboot by itself) but only if there is a /var/adm/crash directory. If you do not have this directory, then no crash dump will be preserved.

If a crash dump was created, it will be stored in the /var/adm/crash directory. The crash dump is a copy of RAM when the crash occurred and as such, provides very little information for the average sysadmin. Yes, you can decode the messgae buffer to see what was on the screen when the system crashed but this won't tell you what to fix.

About all you can do is to run q4 and look over the patch lists to see if there is a match between the descriptions of the patches and the output of q4. For information about crash dumps, see:

ftp://contrib:9unsupp8@hprc.external.hp.com/crash

[printaporn]

mostly of the case is system panic
that you can check for more information in /etc/shutdownlog

then keep you core files in /var/adm/crash
and send it to Response Center for analyze.

[Antoanetta Naghiu]

Get q4 if you do not have installed (see /usr/contrib/bin/q4)
cd /var/adm/crash/crash.0 (or whatever is your crash file version)
run q4prep -p
q4 -p .
q4>trace event 0
q4>trace
q4>include analyze.pl
q4>run Analyze AU>>file
q4>exit
From system prompt, grep file for panic.
Good luck.