'\" te
.\" Copyright (c) 2004, 2013, Oracle and/or its affiliates. All rights reserved.
.\" Copyright (c) 1983 Regents of the University of California. All rights reserved. The Berkeley software License Agreement specifies the terms and conditions for redistribution.
.TH savecore 1M "6 Dec 2011" "SunOS 5.11" "System Administration Commands"
.SH NAME
savecore \- save a crash dump of the operating system
.SH SYNOPSIS
.LP
.nf
\fB/usr/bin/savecore\fR [\fB-Lvd\fR] [\fB-f\fR \fIdumpfile\fR] [\fIdirectory\fR]
.fi

.SH DESCRIPTION
.sp
.LP
The \fBsavecore\fR utility saves a crash dump of the kernel (assuming that one was made) and writes a reboot message in the shutdown log. It is invoked by the \fBdumpadm\fR service each time the system boots.
.sp
.LP
\fBsavecore\fR can be configured by \fBdumpadm\fR(1M) to save crash dump data in either a compressed or uncompressed format. For the compressed format, \fBsavecore\fR saves the crash dump data in the file \fB\fIdirectory\fR/vmdump.\fIN\fR\fR, where \fIN\fR in the pathname is replaced by a number which increments by one each time \fBsavecore\fR is run in \fIdirectory\fR. The compressed file can be uncompressed in a separate step using the \fB-f\fR \fIdumpfile\fR option. For the uncompressed format, \fBsavecore\fR saves the crash dump data in the file \fB\fIdirectory\fR/vmcore.\fIN\fR\fR and the kernel's namelist in \fB\fIdirectory\fR/unix.\fIN\fR\fR.
.sp
.LP
Integrity verification of \fBvmdump-*.N\fR files from remote system is done when extraction is performed to \fBvmcore-*.N\fR file. It can be done separately without the extraction by using the \fB-V\fR option. If the verification fails, \fBsavecore\fR marks the file as incomplete.
.sp
.LP
Before writing out a crash dump, \fBsavecore\fR reads a number from the file \fIdirectory\fR\fB/minfree\fR. This is the minimum number of kilobytes that must remain free on the file system containing \fIdirectory\fR. If after saving the crash dump the file system containing \fIdirectory\fR would have less free space the number of kilobytes specified in \fBminfree\fR, the crash dump is not saved. if the \fBminfree\fR file does not exist, \fBsavecore\fR assumes a \fBminfree\fR value of 1 megabyte.
.sp
.LP
The \fBsavecore\fR utility also logs a reboot message using facility \fBLOG_AUTH\fR (see \fBsyslog\fR(3C)). If the system crashed as a result of a panic, \fBsavecore\fR logs the panic string too.
.SH OPTIONS
.sp
.LP
The following options are supported:
.sp
.ne 2
.mk
.na
\fB\fB-d\fR\fR
.ad
.sp .6
.RS 4n
Disregard dump header valid flag. Force \fBsavecore\fR to attempt to save a crash dump even if the header information stored on the dump device indicates the dump has already been saved.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-f\fR \fIdumpfile\fR\fR
.ad
.sp .6
.RS 4n
Save a crash dump from the specified file instead of from the system's current dump device. When given \fB\fIdirectory\fR/vmdump.\fIN\fR\fR, uncompress the file to \fBvmcore.\fIN\fR\fR and \fBunix.\fIN\fR\fR, where \fIN\fR is the same number as in the compressed name.
.sp
This option may also be useful if the information stored on the dump device has been copied to an on-disk file by means of the \fBdd\fR(1M) command.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-L\fR\fR
.ad
.sp .6
.RS 4n
Save a crash dump of the live running Solaris system, without actually rebooting or altering the system in any way. This option forces \fBsavecore\fR to save a live snapshot of the system to the dump device, and then immediately to retrieve the data and to write it out to a new set of crash dump files in the specified directory. Live system crash dumps can only be performed if you have configured your system to have a dedicated dump device using \fBdumpadm\fR(1M).
.sp
\fBsavecore\fR \fB-L\fR does not suspend the system, so the contents of memory continue to change while the dump is saved. This means that live crash dumps are not fully self-consistent.
.RE

.sp
.ne 2
.mk
.na
\fB\fB-v\fR\fR
.ad
.sp .6
.RS 4n
Verbose. Enables verbose error messages from \fBsavecore\fR.
.RE

.SH OPERANDS
.sp
.LP
The following operands are supported:
.sp
.ne 2
.mk
.na
\fB\fIdirectory\fR\fR
.ad
.sp .6
.RS 4n
Save the crash dump files to the specified directory. If \fIdirectory\fR is not specified, \fBsavecore\fR saves the crash dump files to the default \fBsavecore\fR \fIdirectory\fR, configured by \fBdumpadm\fR(1M).
.RE

.SH FILES
.RS +4
.TP
.ie t \(bu
.el o
\fIdirectory\fR\fB/vmcore.\fR\fIN\fR
.RE
.RS +4
.TP
.ie t \(bu
.el o
\fIdirectory\fR\fB/unix.\fR\fIN\fR
.RE
.RS +4
.TP
.ie t \(bu
.el o
\fIdirectory\fR\fB/bounds\fR
.RE
.RS +4
.TP
.ie t \(bu
.el o
\fIdirectory\fR\fB/minfree\fR
.RE
.RS +4
.TP
.ie t \(bu
.el o
\fB/var/crash/`uname -n`\fR (default crash dump directory)
.RE
.SH ATTRIBUTES
.sp
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp

.sp
.TS
tab() box;
cw(2.75i) |cw(2.75i) 
lw(2.75i) |lw(2.75i) 
.
ATTRIBUTE TYPEATTRIBUTE VALUE
_
Availabilitysystem/core-os
.TE

.SH SEE ALSO
.sp
.LP
\fBadb\fR(1), \fBmdb\fR(1), \fBsvcs\fR(1), \fBdd\fR(1M), \fBdumpadm\fR(1M), \fBsvcadm\fR(1M), \fBsyslog\fR(3C), \fBattributes\fR(5), \fBsmf\fR(5)
.SH NOTES
.sp
.LP
The system crash dump service is managed by the service management facility, \fBsmf\fR(5), under the service identifier:
.sp
.in +2
.nf
svc:/system/dumpadm:default
.fi
.in -2
.sp

.sp
.LP
Administrative actions on this service, such as enabling, disabling, or requesting restart, can be performed using \fBsvcadm\fR(1M). The service's status can be queried using the \fBsvcs\fR(1) command.
.sp
.LP
If the dump device is also being used as a swap device, you must run \fBsavecore\fR very soon after booting, before the swap space containing the crash dump is overwritten by programs currently running.
.sp
.LP
When \fBsavecore\fR creates a file it appends the suffix \fB\&.partial\fR. After the file is completed, it is renamed without the suffix. If files are found in the dump directory with this suffix, it means that either \fBsavecore\fR is still busy, or that it was interrupted before completely writing the file. In the former case, use \fBps\fR(1) to find the PID of the running \fBsavecore\fR process and wait for it to complete. In the latter case, remove the partial file and recreate it by running \fBsavecore\fR \fB-d\fR.