No crashdump after system reboot

[Mei Jiao]

HP-UX 11.0
L2000

Server rebooted by itself. However, there's no crashdump in /var/adm/crash/crash.X and /var/tombstones/ts99 has invalid timestamp.

From document: UXDNKBRC00003155
Checked that swapinfo -tam has:
dev 1024 236 788 23% 0 - 1 /dev/vg00/lvol2

From lvlnboot -v:
Dump: lvol2 on: /dev/dsk/c1t2d0, 0

The document mentiones dump device is the swap device, and swapping started, overwriting the dump.

How do I configure to protect against this using /etc/rc.config.d/savecrash?

Thanks in advance.

[Adisuria Wangsadinata_1]

Hi MJ,

1. Check the rc.log & rc.log.old, hope there's a hint from this log files. See whether the system generate the crashdump or not 8-).

You can also check the OLDsyslog.old to capture some hint to see why the system rebooted by itself.

2. Try to call the crashdump again by executing this command below :

# savecrash -r -v /var/adm/crash

3. You can check also your system whether the system can generate the crashdump or not, by doing a TOC process. But make sure you set the sytem to accept this process, see the /etc/rc.config.d/savecrash.

Set the SAVECRASH=1 and SAVECRASH_DIR=/var/adm/crash.

TOC process :
1. CTRL B
2. CM> tc

The reason you need to check with TOC process is to make sure that your system can capture the crashdump in the future into the right place.

Hope this information can help you.

Best Regards,
AW

[James Murtagh]

Hi Mei Jiao,

To ensure your dump is saved after a crash I would create another dump partition for it - if you have the spare disk space - which can also be used as a swap partition. The first step to perform is to verify the necessary pages are included in the dump. You can use the crashconf command to verify this, ideally you would like the following regions - KCODE, USTACK, FSDATA, KDDATA and KSDATA. Unfortunately KCODE wasn't included in the default dump config. To check :

# crashconf -v | egrep -i "kc|fsd|kd|ks" | awk '{print $1, $3}'
KCODE no,
USTACK yes,
FSDATA yes,
KDDATA yes,
KSDATA yes,

To add this from the command line use :

# crashconf -i KCODE

To add it to the startup configuration edit the file /etc/rc.config.d/crashconf and add the entry to the following line :

CRASH_INCLUDED_PAGES="KCODE"

Now you are ready to check the size of the partition needed - ideally run this when the system is at normal or peak usage :

# crashconf -v | awk ' /included/ {printf("%d MB required\n", ($6*4)/1024)}'
164 MB required

So on my system I will need 164 MB save the required dump - I would add 10% to be on the safe side so ~ 180 MB. You then need to create a logical volume, which I will create as sswap in vg01 :

# lvcreate -L 180 -C y -r n -n sswap vg01

You can then add the following lines to /etc/fstab :

/dev/vg01/sswap / swap pri=2 0 0
/dev/vg01/sswap / dump defaults 0 0

Take care to make the swap partition a lesser priority than than primary swap otherwise this will be overwritten too. You can then activate the swap area :

# swapon -a

All that is left is to insure the CRASHCONF_READ_FSTAB variable is set to 1 in /etc/rc.config.d/crashconf and rerun the crashconf startup script :

# /sbin/init.d/crashconf start

Use crashconf -v to check the new dump area has been configured. The dump will write from the end of the last device backwards so that there is less chance it is overwritten.

Cheers,

James.