savecore - save a crash dump of the operating system
/usr/bin/savecore [-L | -r] [-vd] [-f dumpfile] [directory]
The savecore utility saves a crash dump of the kernel (assuming that one
was made) and writes a reboot message in the shutdown log. By default, it is
invoked by the dumpadm service each time the system boots.
Depending on the dumpadm(1M) configuration savecore
saves either the compressed or uncompressed crash dump. The compressed crash
dump is saved in the file directory/vmdump.n.
savecore saves the uncompressed crash dump data in the file
directory/vmcore.n and the kernel's namelist in
directory/unix.n. The trailing n in the
pathnames is replaced by a number which grows every time savecore is
run in that directory.
Before writing out a crash dump, savecore reads a number
from the file directory/minfree. This is the minimum number of
kilobytes that must remain free on the file system containing
directory. If after saving the crash dump the file system containing
directory would have less free space the number of kilobytes
specified in minfree, the crash dump is not saved. if the
minfree file does not exist, savecore assumes a minfree
value of 1 megabyte.
The savecore utility also logs a reboot message using
facility LOG_AUTH (see syslog(3C)). If the system crashed as a
result of a panic, savecore logs the panic string too.
The following options are supported:
Disregard dump header valid flag. Force savecore
to attempt to save a crash dump even if the header information stored on the
dump device indicates the dump has already been saved.
Attempt to save a crash dump from the specified file
instead of from the system's current dump device. This option may be useful if
the information stored on the dump device has been copied to an on-disk file
by means of the dd(1M)
Save a crash dump of the live running Solaris system,
without actually rebooting or altering the system in any way. This option
to save a live snapshot of the system to the dump
device, and then immediately to retrieve the data and to write it out to a new
set of crash dump files in the specified directory. Live system crash dumps
can only be performed if you have configured your system to have a dedicated
dump device using dumpadm(1M)
savecore -L does not suspend the system, so the
contents of memory continue to change while the dump is saved. This means
that live crash dumps are not fully self-consistent.
Open the dump device or file as read-only, and don't
update the dump header or do anything else that might modify the crash dump.
This option can be used to recover a crash dump from a read-only device. This
flag cannot be used in conjunction with -L.
Verbose. Enables verbose error messages from
The following operands are supported:
Save the crash dump files to the specified directory. If
is not specified, savecore
saves the crash dump files
to the default savecore directory
, configured by
default crash dump directory
The system crash dump service is managed by the service management facility,
smf(5), under the service identifier:
Administrative actions on this service, such as enabling,
disabling, or requesting restart, can be performed using svcadm(1M).
The service's status can be queried using the svcs(1) command.
If the dump device is also being used as a swap device, you must
run savecore very soon after booting, before the swap space
containing the crash dump is overwritten by programs currently running.