How does savecore work?

During a system panic, whether forced by the system administrator in response to a system hang or caused by the system, the contents of memory in use at that time are written out to the dump device. When the system is rebooted, savecore can be run to retrieve the image from the dump device and archive it to a disk file. Let's examine this process in more detail.

When panic() executes, it looks into the kernel for the name of the preselected dump device. By default, the dump device is the primary swap device. However, in certain system configurations, such as when the primary swap partition is smaller than memory, a separate, more adequately sized dump device may be chosen .

panic() places the contents of memory in use at the time of the panic toward the back end of the dump device . This little-known fact works to the well-read system administrator's advantage should savecore need to be run manually shortly after booting, assuming that swapping hasn't already overwritten any of the image.

During the next boot up of the system, savecore may be called. savecore is invoked with the name of a preexisting directory where the copy of the image currently held on the dump device is to be saved. We'll refer to that directory as the " savecore directory."

Note

Should the savecore directory not already exist, savecore will not create it automatically. Therefore, it must be created prior to calling savecore.

savecore examines the image stored on the dumpfile device, testing for two conditions.

• The two magic numbers stored in the image on the dumpfile device (one at the beginning of the image, the other at the end) must both match the DUMP_MAGIC value defined in /usr/include/sys/dumphdr.h , 0x8fac0102 on Sun systems. This dual, magic-number test is used to verify that any swapping activity hasn't yet damaged the dump image.

• The dump must be from the same revision of the operating system that is currently executing.

If these conditions are met, the image of memory ( core ) will be placed in the savecore directory as a file called vmcore. X , where X is simply a sequence number. A copy of the kernel namelist will be built and also placed in the savecore directory. It will be named unix. X or vmunix. X , depending on the operating system in use.

The sequence number will start with zero. Once savecore has been run, a file called bounds will exist in the savecore directory along with the savecore files. The bounds file simply contains the sequence number to use for the next execution of savecore .

If you are interested in learning more about the details of the actual dump file layout on your system, refer to /usr/include/sys/dumphdr.h .