CRASH DUMP

[MIGUEL CARABANO]

Where the Crash Dump in HPUX 10,20 is recorded by defect

[nancy rippey]

I believe the default for dump on 10.20 is /etc/rc.config.d/savecore

nancy

[Steven Sim Kok Leong]

Hi,

If you are referring to where the crash dump is saved by the system upon booting up, it is stored in /var/adm/crash.

For HP-UX 11.00, you will also want to check the tombstones residing in /var/tombstones.

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[Bill Hassell · Accepted solution]

When a crash occurs, the operating system instantly stops running and passes control to the processor ROMs. The ROMs will write the contents of memory to the dump area(s) reported by lvlnboot -v. Once the dump is complete, the machine will reboot and the rc scripts will run.

One of the scripts is /sbin/init.d/savecore which is configured with /etc/rc.config.d/savecore. The two parameters that need to be checked are:

SAVECORE=1
SAVECORE_DIR=/var/adm/crash

These are the defaults and it is important to make sure /var/adm/crash has enough space for crash dumps. If not, it is a very good idea to create a separate logical volume for /var/adm/crash.

Once this has been setup, and a crash occurs, the crash files will be in /var/adm/crash, a copy of vmunix as well as the crash file. During the time that the crash isa being copied by the savecore program, the panic string is stored in /etc/shutdownlog. That is where you can see the kernel's reason for the crash.

Note however that typical crash messages are:

data segmentation violation
freeing free frag
freeing free inode
HPMC

and so on. The first msg means that something in the thousands of lines of code made a mistake and an address is odd or does not have a 32bit boundary. mThe next two refer to things that can't happen to the filesystem but if they do, the system goes down hard. The HPMC error is almost always a hardware failure.

Analysis of a crash dump is very complex, but there is a program that can help: q4 Use the man page to see if it can make sense of the crash dump for you.