After a panic, the crash dump is stored under the directory defined as “Savecore directory” on the dumpadm output. The default is /var/crash/`uname -n`. Starting with Solaris 10 Update 9, the crash dump is stored in a single file called vmdump.X, where X is a consecutive number as defined in the /var/crash/`uname -n`/bounds file. Before Solaris 10 update 9, two files are created, the unix.X and the vmcore.X.
Note: Right after the reboot caused by a system panic the savecore command is automatically executed to extract the crash dump from the dump device and save it as a file. Before attempting to perform any operation with the crash dump, make sure that the file is no longer growing or no savecore process is running. If the system is running at least Solaris 10 update 9, extracting the actual crash dump (to obtain the unix.X and vmcore.X files) is needed to interact with it. This can be done with the following command:
# savecore -vf vmdump.0
savecore: System dump time: Sat Feb 27 01:43:17 2016
savecore: saving system crash dump in /var/crash/{unix,vmcore}.0
Constructing namelist /var/crash/unix.0
Constructing corefile /var/crash/vmcore.0
0:08 100% done: 67870 of 67870 pages saved
18796 (27%) zero pages were not written
0:08 dump decompress is done
For the purposes of creating a service request to diagnose the cause of a panic or system hang, if the system is running Solaris 10 Update 9 or newer, only upload the vmdump.X file, for previous versions of Solaris, please upload the unix.X and vmcore.X files.
We can use mdb to perform a quick verification of the crash dump. The commands shown below are to print the header of the crash dump and the stack trace that lead to the panic. If these commands provide an output and no errors are reported on the /var/adm/messages file and/or console log, then there is a good chance that the crash dump was created successfully.
# echo "::status" | mdb -k unix.0 vmcore.0 debugging crash dump vmcore.0 (64-bit) from hostA.oracle.com operating system: 5.11 11.0 (sun4v) image uuid: 6d5e1bb1-16f1-4de9-a12f-ac96c3826144 panic message: forced crash dump initiated at user request dump content: kernel pages only
# echo "*panic_thread::findstack" | mdb -k unix.0 vmcore.0 stack pointer for thread 30014cb98a0: 2a1020e3081 000002a1020e3131 kadmin+0x5a0() 000002a1020e3201 uadmin+0x1c0() 000002a1020e32d1 syscall_trap32+0xcc()
The Oracle Solaris Crash Analysis Tool (SCAT) can also be used to verify and analyze a crash dump, opening the crash dump and using the command “analyze” should be enough to confirm that the crash dump was created properly.