Installation guide

copy of the kernel into files in the default crash directory,
/var/adm/crash. (You can modify the location of the crash directory.) The
savecore command stores the kernel image in a file named vmunix.
n ,
and by default it stores the (compressed) contents of physical memory in a
file named vmzcore.
n .
The
n variable specifies the number of the crash. The number of the crash
is recorded in the bounds file in the crash directory. After the first crash,
the savecore command creates the bounds file and stores the number 1
in it. The command increments that value for each succeeding crash.
The savecore command runs early in the reboot process so that little or
no system swapping occurs before the command runs. This practice helps
ensure that crash dumps are not corrupted by swapping.
13.6.3.2 Crash Dump Logging
Once the savecore command writes the crash dump files, it performs the
following steps to log the crash in system log files:
1. Writes a reboot message to the /var/adm/syslog/auth.log file. If
the system crashed due to a panic condition, the panic string is
included in the log entry.
You can cause the savecore command to write the reboot message to
another file by modifying the auth facility entry in the syslog.conf
file. If you remove the auth entry from the syslog.conf file, the
savecore command does not save the reboot message.
2. Attempts to save the kernel message buffer from the crash dump. The
kernel message buffer contains messages created by the kernel that
crashed. These messages might help you determine the cause of the
crash.
The savecore command saves the kernel message buffer in the
/var/adm/crash/msgbuf.savecore file, by default. You can change
the location to which savecore writes the kernel message buffer by
modifying the msgbuf.err entry in the /etc/syslog.conf file. If
you remove the msgbuf.err entry from the /etc/syslog.conf file,
savecore does not save the kernel message buffer.
Later in the reboot process, the syslogd daemon starts up, reads the
contents of the msgbuf.err file, and moves those contents into the
/var/adm/syslog/kern.log file, as specified in the
/etc/syslog.conf file. The syslogd daemon then deletes the
msgbuf.err file. For more information about how system logging is
performed, see the syslogd
(8) reference page.
3. Attempts to save the binary event buffer from the crash dump. The
binary event buffer contains messages that can help you identify the
13–18 Administering Events and Errors