'\" te .\" Copyright (c) 2008, 2015, Oracle and/or its affiliates. All rights reserved. .TH dumpadm 1M "23 Feb 2015" "SunOS 5.11" "System Administration Commands" .SH NAME dumpadm \- configure operating system crash dump .SH SYNOPSIS .LP .nf \fB/usr/sbin/dumpadm\fR [\fB-enpuy\fR] [\fB-c\fR \fIcontent-type\fR] [\fB-d\fR \fIdump-device\fR] [\fB-m\fR \fImin\fRk | \fImin\fRm | \fImin\fR%] [\fB-s\fR \fIsavecore-dir\fR] [\fB-r\fR \fIroot-dir\fR] [\fB-z\fR on | off] .fi .SH DESCRIPTION .sp .LP The \fBdumpadm\fR program is an administrative command that manages the configuration of the operating system crash dump facility. A crash dump is a copy of the physical memory of the computer at the time of a fatal system error. When a fatal operating system error occurs, a message describing the error is printed to the console. The operating system then generates a crash dump by preserving the contents of physical memory in RAM. If this is not possible, the contents of physical memory are written to a predetermined dump device, which is typically a local disk partition. A local disk partition is required when \fBall\fR or \fBallproc\fR are specified. .sp .LP Fatal operating system errors can be caused by bugs in the operating system, its associated device drivers and loadable modules, or by faulty hardware. Whatever the cause, the crash dump itself provides invaluable information to your support engineer to aid in diagnosing the problem. As such, it is vital that the crash dump be retrieved and given to your support provider. Following an operating system crash, the \fBsavecore\fR(1M) utility is executed automatically during boot to retrieve the crash dump and write it to your file system in compressed form, to files named \fBvmdump.\fR\fIX\fR, and \fBvmdump-.\fR\fIX\fR, where \fIX\fR is an integer identifying the dump. Afterwards, \fBsavecore\fR(1M) can be invoked on the same or another system to expand the compressed crash dump to files named \fBvmcore.\fR\fIX\fR and \fBvmcore-.\fR\fIX\fR. The directory in which the crash dump is saved on reboot can be configured using \fBdumpadm\fR command. .sp .LP By default dedicated ZFS volumes are used for swap and dump areas. For further information about setting up a dump area with ZFS, see the \fIZFS Administration Guide\fR. .sp .LP To view the current dump configuration, use the \fBdumpadm\fR command with no arguments: .sp .in +2 .nf example# \fBdumpadm\fR Dump content: kernel pages with ZFS metadata Dump device: /dev/zvol/dsk/rpool/dump (dedicated) Savecore directory: /var/crash Savecore enabled: yes Save compressed: yes .fi .in -2 .sp .sp .LP When no options are specified, \fBdumpadm\fR displays the current crash dump configuration. The example above shows the set of default values: the dump content is set to kernel memory pages and ZFS meta data only. The crash dump will be preserved in memory, or if needed a dump device will be used. The dump device is by default a \fBzvol\fR in the root pool. The directory for \fBsavecore\fR files is set to \fB/var/crash/.\fR\fBsavecore\fR is set to run automatically on reboot and save the crash dump in a compressed format. .sp .LP When one or more options are specified, \fBdumpadm\fR verifies that your changes are valid, and if so, reconfigures the crash dump parameters and displays the resulting configuration. You must be \fBroot\fR to view or change dump parameters. .sp .LP Upon system installation, \fBdumpadm\fR establishes a dump device of sufficient size, based on kernel memory and other internal information, to accommodate a dump file. If you subsequently attempt to create a dump device that is too small to store the dump file, \fBdumpadm\fR issues an error message and the operation fails. .SH OPTIONS .sp .LP The following options are supported: .sp .ne 2 .mk .na \fB\fB-c\fR \fIcontent-spec\fR\fR .ad .sp .6 .RS 4n Modify the dump configuration so that the crash dump consists of the specified dump content. The \fIcontent-spec\fR comprises of optional content-type and content modifiers: .sp .ne 2 .mk .na \fB[ \fIcontent-type\fR ] [ \fIcontent-modifier\fR | -\fIcontent-modifier\fR.. ]\fR .ad .sp .6 .RS 4n \fIcontent-type\fR provides the basis, the content modifiers further change the contents to be dumped. With \fB+\fR, the content modifiers add extra data to be dumped, with \fB-\fR the data is left out. .sp The content-type can be one of the following: .sp .ne 2 .mk .na \fB\fBkernel\fR\fR .ad .RS 11n .rt Kernel memory pages only. Note that this includes only basic set of kernel pages, that is, not the pages which can be specified with content modifiers. .RE .sp .ne 2 .mk .na \fB\fBall\fR\fR .ad .RS 11n .rt All memory pages. If all is specified, the system image is written to the dump device. Note that the resulting dump will include pages for filesystem buffers. .RE .sp .ne 2 .mk .na \fB\fBcurproc\fR\fR .ad .RS 11n .rt Kernel memory pages (as specified by 'kernel'), and the memory pages of the process whose thread was currently executing on the CPU on which the crash dump was initiated. If the thread executing on that CPU is a kernel thread not associated with any user process, only kernel pages will be dumped. .RE .sp .ne 2 .mk .na \fB\fBallproc\fR\fR .ad .RS 11n .rt Kernel memory pages (as specified by 'kernel') and all process pages. If allproc is specified, the system image is written to the dump device. .RE The \fIcontent-modifier\fR can be one of the following: .sp .ne 2 .mk .na \fB\fBzfs\fR\fR .ad .RS 7n .rt Kernel pages which store ZFS metadata. .RE The \fIcontent modifiers\fR affect which portions of kernel memory are dumped and which are not. They do not have any effect when the 'all' content type is set. .sp If no \fIcontent-type\fR is specified then the currently configured content type will be modified. .RE .RE .sp .ne 2 .mk .na \fB\fB-d\fR \fIdump-device\fR\fR .ad .sp .6 .RS 4n Modify the dump configuration to use the specified dump device. The dump device may one of the following: .sp .ne 2 .mk .na \fB\fIdump-device\fR\fR .ad .sp .6 .RS 4n A specific dump device specified as an absolute pathname, such as\fB/dev/dsk/\fR\fIcNtNdNsN\fR or a ZFS volume, such as \fB/dev/zvol/dsk/rpool/dump\fR. .RE .sp .ne 2 .mk .na \fB\fBswap\fR\fR .ad .sp .6 .RS 4n If the special token \fBswap\fR is specified as the dump device, \fBdumpadm\fR examines the active swap entries and selects the most appropriate entry to configure as the dump device. See \fBswap\fR(1M). Refer to the \fBNOTES\fR below for details of the algorithm used to select an appropriate swap entry. .sp A given ZFS volume cannot be configured for both the swap area and the dump device. .RE .sp .ne 2 .mk .na \fB\fB-e\fR\fR .ad .sp .6 .RS 4n Print estimate of disk space required for storing compressed crash dump. The value is computed using current configuration and currently running system. .RE .RE .sp .ne 2 .mk .na \fB\fB-m\fR \fImin\fR\fBk\fR | \fImin\fR\fBm\fR | \fImin\fR\fB%\fR\fR .ad .sp .6 .RS 4n Create a \fBminfree\fR file in the current savecore directory indicating that \fBsavecore\fR should maintain at least the specified amount of free space in the file system where the savecore directory is located. The \fBmin\fR argument can be one of the following: .sp .ne 2 .mk .na \fB\fBk\fR\fR .ad .sp .6 .RS 4n A positive integer suffixed with the unit \fBk\fR specifying kilobytes. .RE .sp .ne 2 .mk .na \fB\fBm\fR\fR .ad .sp .6 .RS 4n A positive integer suffixed with the unit \fBm\fR specifying megabytes. .RE .sp .ne 2 .mk .na \fB\fB%\fR\fR .ad .sp .6 .RS 4n A % symbol, indicating that the \fBminfree\fR value should be computed as the specified percentage of the total current size of the file system containing the savecore directory. .RE The \fBsavecore\fR command will consult the \fBminfree\fR file, if present, prior to writing the dump files. If the size of these files would decrease the amount of free disk space below the \fBminfree\fR threshold, no dump files are written and an error message is logged. The administrator should immediately clean up the savecore directory to provide adequate free space, and re-execute the \fBsavecore\fR command manually. The administrator can also specify an alternate directory on the \fBsavecore\fR command-line. .RE .sp .ne 2 .mk .na \fB\fB-n\fR\fR .ad .sp .6 .RS 4n Modify the dump configuration to not run \fBsavecore\fR automatically on reboot. This is not the recommended system configuration. The system will attempt to preserve a crash dump image in memory. If \fBdumpadm\fR \fB-n\fR is set, then the crash dump image is written to the dump device after the system is rebooted. \fBsavecore\fR(1M) can then be run once the system has booted up to extract the crash dump to the \fBsavecore\fR directory. .sp If the dump device is a swap partition, the dump data will be overwritten as the system begins to swap. If \fBsavecore\fR is not executed shortly after boot, crash dump retrieval may not be possible. .RE .sp .ne 2 .mk .na \fB\fB-p\fR\fR .ad .sp .6 .RS 4n Produce machine parseable output. .RE .sp .ne 2 .mk .na \fB\fB-r\fR \fIroot-dir\fR\fR .ad .sp .6 .RS 4n Specify an alternate root directory relative to which \fBdumpadm\fR should create files. If no \fB-r\fR argument is specified, the default root directory \fB/\fR is used. .RE .sp .ne 2 .mk .na \fB\fB-s\fR \fIsavecore-dir\fR\fR .ad .sp .6 .RS 4n Modify the dump configuration to use the specified directory to save files written by \fBsavecore\fR. The directory should be an absolute path and exist on the system. If upon reboot the directory does not exist, it will be created prior to the execution of \fBsavecore\fR. See the \fBNOTES\fR section below for a discussion of security issues relating to access to the savecore directory. The default savecore directory is \fB/var/crash/\fR. .RE .sp .ne 2 .mk .na \fB\fB-u\fR\fR .ad .sp .6 .RS 4n Forcibly update the kernel dump configuration based on the contents of \fB/etc/dumpadm.conf\fR. Normally this option is used only on reboot when starting \fBsvc:/system/dumpadm:default\fR, when the \fBdumpadm\fR settings from the previous boot must be restored. Your dump configuration is saved in the configuration file for this purpose. If the configuration file is missing or contains invalid values for any dump properties, the default values are substituted. Following the update, the configuration file is resynchronized with the kernel dump configuration. .RE .sp .ne 2 .mk .na \fB\fB-y\fR\fR .ad .sp .6 .RS 4n Modify the dump configuration to automatically run \fBsavecore\fR on reboot. This is the default for this dump setting. See \fBNOTES\fR. .RE .sp .ne 2 .mk .na \fB\fB-z\fR \fBon\fR | \fBoff\fR\fR .ad .sp .6 .RS 4n Modify the dump configuration to control the operation of \fBsavecore\fR on reboot. The options are \fBon\fR, to enable saving core files in a compressed format, and \fBoff\fR, to automatically uncompress the crash dump file. The default is \fBon\fR, because crash dump files can be very large and require less file system space if saved in a compressed format. .RE .SH EXAMPLES .LP \fBExample 1 \fRReconfiguring The Dump Device to store current process pages and no ZFS meta data pages .sp .in +2 .nf \fBexample# dumpadm -c curproc-zfs\fR Dump content: kernel and current process pages without ZFS metadata Dump device: /dev/zvol/dsk/rpool/dump (dedicated) Savecore directory: /var/crash Savecore enabled: yes Save compressed: on .fi .in -2 .sp .LP \fBExample 2 \fRSpecifying \fBallproc\fR or \fBall\fR content .sp .LP If \fBallproc\fR or \fBall\fR content are specified no attempt is made to preserve crash dump in memory .sp .in +2 .nf example# \fBdumpadm -c all\fR Dump content: all Dump device: /dev/zvol/dsk/rpool/dump (dedicated) Savecore directory: /var/crash Savecore enabled: yes Save compressed: on .fi .in -2 .sp .LP \fBExample 3 \fRPreserving crash dump if \fBsavecore\fR is diabled .sp .LP If savecore is disabled, the crash dump will be preserved in memory and copied to the dump device. It can be extracted later by running \fBsavecore\fR(1M) manually .sp .in +2 .nf example# \fBdumpadm -n -c kernel+zfs\fR Dump content: kernel with ZFS metadata Dump device: /dev/zvol/dsk/rpool/dump (dedicated) Savecore directory: /var/crash Savecore enabled: yes Save compressed: on .fi .in -2 .sp .SH EXIT STATUS .sp .LP The following exit values are returned: .sp .ne 2 .mk .na \fB\fB0\fR\fR .ad .sp .6 .RS 4n Dump configuration is valid and the specified modifications, if any, were made successfully. .RE .sp .ne 2 .mk .na \fB\fB1\fR\fR .ad .sp .6 .RS 4n A fatal error occurred in either obtaining or modifying the dump configuration. .RE .sp .ne 2 .mk .na \fB\fB2\fR\fR .ad .sp .6 .RS 4n Invalid command line options were specified. .RE .SH FILES .sp .ne 2 .mk .na \fB\fB/dev/dump\fR\fR .ad .sp .6 .RS 4n Dump device. .RE .sp .ne 2 .mk .na \fB\fB/etc/dumpadm.conf\fR\fR .ad .sp .6 .RS 4n Contains configuration parameters for \fBdumpadm\fR. Modifiable only through this command. .RE .sp .ne 2 .mk .na \fB\fIsavecore-directory\fR\fB/minfree\fR\fR .ad .sp .6 .RS 4n Contains minimum amount of free space for \fIsavecore-directory\fR. See \fBsavecore\fR(1M). .RE .SH ATTRIBUTES .sp .LP See \fBattributes\fR(5) for descriptions of the following attributes: .sp .sp .TS tab() box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) . ATTRIBUTE TYPEATTRIBUTE VALUE _ Availabilitysystem/core-os .TE .SH SEE ALSO .sp .LP \fBsvcs\fR(1), \fBuname\fR(1), \fBsavecore\fR(1M), \fBsvcadm\fR(1M), \fBswap\fR(1M), \fBattributes\fR(5), \fBsmf\fR(5) .SH NOTES .sp .LP The system crash dump service is managed by the service management facility, \fBsmf\fR(5), under the service identifier: .sp .in +2 .nf svc:/system/dumpadm:default .fi .in -2 .sp .sp .LP Administrative actions on this service, such as enabling, disabling, or requesting restart, can be performed using \fBsvcadm\fR(1M). The service's status can be queried using the \fBsvcs\fR(1) command. .SS "Dump Device Selection" .sp .LP When the special \fBswap\fR token is specified as the argument to \fBdumpadm\fR \fB-d\fR the utility will attempt to configure the most appropriate swap device as the dump device. \fBdumpadm\fR configures the largest swap block device as the dump device; if no block devices are available for swap, the largest swap entry is configured as the dump device. If no swap entries are present, or none can be configured as the dump device, a warning message will be displayed. While local and remote swap files can be configured as the dump device, this is not recommended. .SS "Dump Device/Swap Device Interaction" .sp .LP In the event that the dump device is also a swap device, and the swap device is deleted by the administrator using the \fBswap\fR \fB-d\fR command, the \fBswap\fR command will automatically invoke \fBdumpadm\fR \fB-d\fR \fBswap\fR in order to attempt to configure another appropriate swap device as the dump device. If no swap devices remain or none can be configured as the dump device, the crash dump will be disabled and a warning message will be displayed. Similarly, if the crash dump is disabled and the administrator adds a new swap device using the \fBswap\fR \fB-a\fR command, \fBdumpadm\fR \fB-d\fR \fBswap\fR will be invoked to re-enable the crash dump using the new swap device. .sp .LP Once \fBdumpadm\fR \fB-d\fR \fBswap\fR has been issued, the new dump device is stored in the configuration file for subsequent reboots. If a larger or more appropriate swap device is added by the administrator, the dump device is not changed; the administrator must re-execute \fBdumpadm\fR \fB-d\fR \fBswap\fR to reselect the most appropriate device fom the new list of swap devices. .SS "Minimum Free Space" .sp .LP If the \fBdumpadm\fR \fB-m\fR option is used to create a \fBminfree\fR file based on a percentage of the total size of the file system containing the \fBsavecore\fR directory, this value is not automatically recomputed if the file system subsequently changes size. In this case, the administrator must re-execute \fBdumpadm\fR \fB-m\fR to recompute the \fBminfree\fR value. If no such file exists in the \fBsavecore\fR directory, \fBsavecore\fR will default to a free space threshold of one megabyte. If no free space threshold is desired, a minfree file containing size 0 can be created. .sp .LP If there is insufficient space in the dump directory, and system preserved a crash dump image in memory, then the image is written to the dump device for later extraction using \fBsavecore\fR(1M). .SS "Security Issues" .sp .LP If, upon reboot, the specified \fBsavecore\fR directory is not present, it will be created prior to the execution of \fBsavecore\fR with permissions 0700 (read, write, execute by owner only) and owner \fBroot\fR. It is recommended that alternate savecore directories also be created with similar permissions, as the operating system crash dump files themselves may contain secure information. .SS "Default for \fBsavecore\fR" .sp .LP System installation software might reserve a dedicated dump device (for example, a disk slice or a ZFS volume). In such a case, the \fBdumpadm\fR default can be set to \fB-n\fR, meaning that \fBsavecore\fR does not run automatically when the system reboots. A crash image will be preserved on the dump device even if initially it was preserved in memory. Run \fB/usr/bin/savecore\fR manually as root to retrieve the crash image and copy it to set of files under \fB/var/crash\fR. The crash image will remain on the dump device until overwritten by a later one.