Wednesday, April 24, 2013

Solaris 2.x Core Dump Analysis

Solaris 2.x Core Dump Analysis

If you are having trouble getting a core dump, see the savecore page.

Several useful pieces of information can be found by running strings on the vmcore.# file and piping it through more or grep: strings vmcore.# | more. In particular, this will tell you the architecture of the system and the OS level. The message buffer is also near the top of the strings output, and may include messages that had not been written to the console or log files yet. (Note that the message buffer is a ring buffer, so the messages may not be in cronological order.)

If the system panic'ed due to a bad trap, adb can determine the instruction that was running at the time of the crash.

crash can also provide useful information, including lock and kernel memory allocation. crash output is notably less cryptic than adb output.

Some netstat, nfsstat and arp commands are also available for crash dumps. After running the command on the corefiles (eg netstat -d unix.# vmcore.#), compare the output to that on the live system, since some of the options do not report the crash dump statistics.

ipcs can also be used with crash dumps in the following format: ipcs -a -C vmcore.# -N unix.# See the IPC page for information on these facilities.

No comments: