Right size of Dump device and "/var/adm/crash"

[R.O.]

Hi,

Given these data from crashconf:

Total pages on system: 753660
Total pages included in dump: 151649

To properly configure the dump device so that I don´t have a truncated crash dump in case of a system crash, Is this correct to know how much space I need to save crash dumps?

Total pages included in dump: 151649 * physical page size = 4096 bytes

Once the data is written in the dump device, it will be saved compressed in "/var/adm/crash", but what is the compression ratio? I mean, how can I know the right size of my "/var/adm/crash"??

Thanks in advance,

R.O.

[Bill Hassell]

A truncated crash dump is not necessarily bad. In general, having enough space to hold about 25% of your RAM size will be adequate for each crash. So if you have 16Gb of RAM, then a 4Gb space for /var/adm/crash will be adequate. The important kernel stuff is in the first few hundred megs, followed by process and user data areas and shared memory. Most of the crashes don't need user information (but occasionally it is needed to understand what state the kernel was in at the time of the crash. I would allow for at least two crash dumps. A good idea is to make /var/adm/crash a separate mountpoint. You DO NOT want /var to fill up.

[Steven E. Protter]

Shalom,

The dump device is supposed to be at minimum half of RAM on the system. Default configuration uses swap space to hold the dump before savecrash moves it to a filesystem.

Some like to have a different device for dump.

The size of the file depends on what happens. I know of no documentation on the compression ratio.

SEP

[A. Clay Stephenson]

Another option (especially now that boot disks are large but still should only be used for directly OS-related stuff) is to disable savecrash so that a dump does not get written to /var. By default, dump and primary swap are one and the same but if you configure separate dump and swap spaces then there is no reason to save the dump to /var because it will not be overwritten by swap usage. This can also save you several minutes during a reboot cycle because the image does not have to be compressewd and moved.

[R.O.]

Hi,

Yes I know, but it is not in my hand to separate the dump device from the swap device. I have several systems with different amounts of memory and swap and what I want to know is whether I have properly sized the dump device and the "/var/adm/crash" for each one. Knowing the size of the memory I need to know if the dump device and the "/var/adm/crash" are big enough to hold the crash.

Regards,

[Alex Glennie]

you could run crashconf out of cron and look at the value of "Total pages included in dump" (if it panic'd at this point in time), note this is in pages and typically this is 4k.

Then compare this with the section at the bottom which tells you how much space you have configured. If configured > total pages to dump , then you're ok , else add more raw space ?

[Bill Hassell]

Since you have several systems with different sizes for swap/dump, the first check is the size of the dump volume. It doesn't matter how big you make /var/adm/crash if the dump area is very small -- the crash will be truncated. After looking at the dump area, then run crashconf to see what is required for at least one crash dump. Note that if /var/adm/crash is full with an old dump, any new crash won't have any space. Be sure to move crash dumps somewhere else on the same day that it occurs.

[Geoff Wild]

We make /var/adm/crash a separate filesystem - usually 512 MB more then the amount of ram in a system.

Rgds...Geoff

[R.O.]

Hi,

On more question,,the compression of the dump data, ¿is done while dumping to "/var/adm/crash" or it is first copied to "/var/adm/crash" and afterwards, compressed?

Regards,

R.O.