Core files and crash dump on hpux 11.11i

[Shivkumar]

Dear Sirs,

I have following questions on core dump and core files:

1) Are core file and crash dump files the same ?

2) If the location of the core dump is not specified; will it core dump in root directory ?

3) Is core file dumped from where the confused process were running ?

4) Are core dumps due to system panic and system files failures the same ?

5) In case of /var/adm/crash not having sufficient disk space left for crash dump, what would happen ?

6) In case of core dump in / (root) file system getting full 100%; will system stop functioning ?

Appreciate your suggestions.

Thanks,
Shiv

[A. Clay Stephenson · Accepted solution]

1) No, A core file is the result of an ordinary program aborting for any number of reason such as an unexpected signal, bad code, failed device, ... . A crash dump occurs when the kernel itself undergoes an unexpected event.

2) No, the core file is always written to the current working directory.

3) See answer 2.

4) No, see answer 1.

5) The filesystem would fill up and as large an image as could be written would be retained. This assumes that you did not set up a separate dump and swap area. If different swap and dump areas are defined then no saving in var/adm/crash is needed.

6) Generally no but you must clean it up immediately. It's usually much more serious to fill up /var.

Crashes should not occur in production machines. I literally have not had one in years although they might be rather common in test and sandbox environemnts. This should be part of your testing cycle.

[Raj D.]

Hi Shiv ,

1) Are core file and crash dump files the same ?

Core files generates when some process terminates abnormally , and it creates core file .
# file core [ To check the type of file. ]
You can also do # strings core | more [ To know details of the core file generation. ]

The crash dump , happens when a system panic or system hang , fault , hw problem . or TC happens. And it dumps the running memory contents on the dump device . And can be found on /var/adm/crash/crash.x

With this format :image.1.1.gz , also vmunix.gz

Q4 is the tool to analyse the crash dump , also HP provides collection.sh tool with crashinfo binary.

Hope this will help ,

Cheers,
Raj.

[Raj D.]

Shiv,

Also check for the /var/tombstones/ts99 file for any crash details. Look for valid cpu time stamp.

Cheers,
Raj.

[Rick Garland]

core files and crashes are not the same.

An example; The core will be placed into the CWD where an application is having problems.

The crash dumps can be the result of system panics.

If you do not have room for the full crash dump, you will get part of it until space runs out.

If you get a / filesystem that is 100%, you will have problems. But if you have a core dumping into the root filesystem, then a question would be "are you running an application from the root?"

There is 'crashconf' file that allows you to configure what is saved from a crash and where that crash dump is placed.

This configuration is in /etc/rc.config.d/crashconf

Look into creating a separate filesystem for the crash dumps. This can prevent the /var filesystem from filling up.

[Arunvijai_4]

1) Core file is generated by any program when it experiences abnormalities. Whereas, Crash dump is kernel specific. When Kernel panic happens, it generates Crash dump

2) Nope, It will be grenerated in the dir where you started the program.

3) Same as #2

4) No, System panic happens at the kernel level, core dumps generated at Application level.

5) FS would get filled up by largeset crash dump.

6) Nope, Many apps wont be able to run and generates error logs.

-Arun

[Yogeeraj_1]

hi shiv,

normally the core files are created in the home directory of the owner of the process.

Advance systems like Oracle have their core file dumped in specific directories. In this case the "cdump" directory

hope this helps too!

kind regards
yogeeraj

[Arunvijai_4]

Shiv, have a look at these links, it should give better understanding of Core dumps and crash dumps,

http://docs.hp.com/en/J2237-90005/ch06s05.html
[Generating and Retrieving System Core Dumps]

http://en.wikipedia.org/wiki/Core_dump

http://www.unixguide.net/hp/hpuxcrashdump.shtml

-Arun

[Chan 007]

Hi Shiv,

Few points,

1. Applications other than OS does is a core and it dumps at the area where it was called from.

2. Crash Dumps are from Core OS, which are classified into 2 (Hardware Crash and OS Crash). They will be dumped in /var/adm/crash.

3. If it does not have enough space it will skill after the space is full. Practically the system will have space for all.
You can find how much is needed by crashconf -v, grep for total inclused.

4. For you #4. No, as file failure means application i assume.

5. Root is not used for dumps. Only if you (root) use an application that crashes and gives a core file, it may remain in root.

Cheers...007