savecrash/savecore

[Tim Nelson]

Can anyone give me a clear concise discription on what happens when an HP-UX server panics and crashes. Specifically discribe the role/function of savecrash/savecore. Please address how /var/adm/crash becomes populated with core dumps.

I've read the man page and it just isn't very clear to me.
Thank you for your response.

Kirk

[Alan Riggs · Accepted solution]

Briefly:
When a panic occurs the operating system preserves an image or running memory in dump space. When the box reboot, savecore runs (assuming that it is configured to run automatically at boot). If savecore finds a dump, it will begin writing system core files to the dump directory (/var/adm/crash is the default). System cores are identified by a numeerical index (core.0, core.1, etc.). If primary paging is used as a dump device also, then savecore disables paging to that device (if it has not already been enabled) while the core is being written.

If possible, particularly on large systems, use separate dedicated dump spaces so that primary paging can be enabled and so that savecore can run in the background. This can greatly improve recovery speed by reducing boot time. savecore will print a warning message if a complete dump cannot be saved. It is also possible to dump to tape if insufficient disk space is available.

[CHRIS_ANORUO]

Hi,

You have to set the SAVECORE=1 parameter in /etc/rc.config.d/savecore.
Go through the options on in that savecore file.
Make sure you have aenough space to save a complete core dump.
Also you can read core dumps with the strings command.

Cheers!

[Paul Hite]

Well, when the kernel is running, sometimes it encounters an impossible situation. At this point it makes an effort to write a copy of all of memory (or as much as will fit) into the dump area. The dump area is a raw device and sometimes a swap area doubles as the dump area.

A second thing that can happen is that the kernel will just hang. There is a procedure that can be used to do a "tranfer of control" manually to a routine that attempts to dump core in the dump area.

Either way, when the box reboots, you need to save that dump in the filesystem as file. You also need a copy of the kernel. savecrash has the job of copying the dump from the dump area to filesystem somewhere and /var/adm/crash is the default.

Typically, most users at this point will need to send the dump to HP for analysis, but very savvy users sometimes can do some analysis themselves.

savrcrash needs to run immediately upon reboot because usually the dump area is only a swap area. It's gotta save that dump before any paging occurs.

savecore was the predecessor to savecrash and is now retired.

If this doesn't answer your questions, please post a more specific question.

[Alan Riggs]

Paul:
Savecore has not been retired in 10.20. At least, not to the best of my knowledge.

[Paul Hite]

Yeah, but 11.00 has been out for awhile.

[Patrick Wessel]

Alan answerd this question almost perfect. I just want to add a white paper. Click on the paper clip to read it