Fail in to create dump files

[Natalia_8]

Srs.

Please, i need your help. Our Server Risc N4000, suffered a system PANIC of X25 link and rebooted. It created the image files (logs of dump), but they were removed quickly. We don´t know how ou who can do that, but there wasn´t command line or script registed on the ssytem to indicate the cause of this "deleting". Thera are register fos created files on the file INDEX. Did you see thes situation any time? Due to this we couldn´t determine the real cause of PANIC ou apply the correcto solution of this.

T

[RAC_1]

The files that control the crash saving is
/etc/rc.config.d/savecrash. If set to 1, will save crash.

Default - /var/adm/crash

/etc /rc.config.s/crashconf will control, what to save(what pages etc.) compresssion options. man crashconf.

If these have set, it should have saved the crash. /var/adm/crash should be large enough to avoid space problem.

If the crash has been removed, then, you may look at /var/tombstones/ts99 file. If the crash was because of hardware problems, you will get some info in this file.

Anil

[Natalia_8]

S.O is 11 version.

[Natalia_8]

Well, the savecrash is enabled. We can´t find anything in the ts99 file to indicate hardware error and the parameter crash)included_pages has the value = "".
I think these values are correct, aren´t they ?

This is a mister

[Sundar_7]

Hi Natalia,

You can again run the savecrash command from the command line to save the crash dumps from the dump volume to the file system (/var/adm/crash by default).

# savecrash -r

If your swap and dump is seperate then you are sure to get the dump copied to your fs. If not, chances are there that your paging system had already overwritten the dump headers if your swap system was ever 100% used.

-- Sundar.

[Natalia_8]

The PANIC ocurred at june 26 th and now the server is working. In What moment should i run this command savecrash -r ? Shouldn´t the system have run this command at the momento of reboot ?

The swap and crash are separated.
than

[Sundar_7]

As mentioned above, if you have SAVECRASH variable in /etc/rc.config.d/savecrash file set to 1 then the system should have saved the dump in /var/adm/crash.

Did you look at /etc/rc.log for errors from savecrash ?

You can run savecrash -r anytime even when the system is running in multiuser mode.

[Natalia_8]

Hi Sundar,

There aren´t errors in the rc.log log.
The parameter savecrash is equal to 1.
And now, it´s no use to run savecrash -r because we won´t have the "image" of the server´s memory at the moment of the PANIC.
Than

[Sundar_7]

savecrash -r WILL save the dump info from the dump volume to the filesystem. Since you have the seperate swap and dump volume, you are sure to get the dump info from the time of the system PANIC.

[Natalia_8]

Hi Sundar,

There aren´t errors in the rc.log log.
The parameter savecrash is equal to 1.
And now, it´s no use to run savecrash -r because we won´t have the "image" of the server´s memory at the moment of the PANIC.
Than

[Natalia_8]

Hi Sundar,

There aren´t errors in the rc.log log.
The parameter savecrash is equal to 1.
And now, it´s no use to run savecrash -r because we won´t have the "image" of the server´s memory at the moment of the PANIC.
Than

[Natalia_8]

Ok!!!