Questions and Answers

  Amy Rich

Q. Our Ultra 60 running Solaris 8 keeps crashing on us, and I want to do some crash dump analysis. Unfortunately, I don’t really know how to go about getting the crash dump, or how to read the dump once I have it. Could you offer some advice?

A. I highly recommend the book Panic! Unix System Crash Dump Analysis, by Chris Drake and Kimberley Brown (Prentice Hall, 1995, ISBN 0131493868). I’m not sure if both of the authors are still with Sun, but they were when they wrote the book. Although this book is a bit dated, and I really wish they would put out a second edition for the Ultra SPARC family, this book is still the bible for analyzing UNIX system crashes. It covers:

• The difference between panics and hangs
• Header files, symbols, and symbol tables
• A tutorial on how to use adb
• The stack and stack traces
• An introduction to assembly
• An overview of UNIX internals
• The SPARC processor and instruction set

Here is some basic information to get you started. Make sure that you have savecore enabled, or you’re not going to get a crash dump. In Solaris 8, savecore is enabled by default, but if it has been disabled for some reason, you can re-enable it by running:

/usr/sbin/dumpadm -y

This modifies /etc/dumpadm.comf so that savecore automatically runs for every reboot. Also make sure that /etc/rc2.d/S75savecore exists and is intact. If you look at /etc/dumpadm.conf, you’ll see that it also stores the directory location of the crash dumps, usually /var/crash/'/bin/uname -n'/. If you have changed machine names, you’ll need to change dumpadm.conf to reflect the new machine name. Also be sure that you have a valid disk slice (like /dev/dsk/c0t0d0s1) listed after DUMPADM_DEVICE=, and not part of a DiskSuite or Veritas mirror.