HP-UX System Administrator's Guide: Overview HP-UX 11i v3 (B3921-90011, September 2010)

Dual-Mode Devices (dump / swap)
By default, savecrash is enabled and performs its copy during the boot process. You can disable
this operation by editing the /etc/rc.config.d/savecrash file, setting the SAVECRASH
environment variable to a value of 0. This is generally safe to do if your dump devices are not
also being used as paging devices.
From the savecrash(1M) manpage:
• “If there is insufficient space in the file system for the portions of the crash dump that need
to be saved, savecrash will save as much as will fit in the available space. (Priority is given
to the index file, then to the kernel module files, and then to the physical memory image.)
The dump will be considered saved, and savecrash will not attempt to save it again, unless
there was insufficient space for any of the physical memory image. (See the description of
option -r.)”
The -r option to savecrash allows you to resave a crash that has already been marked as saved.
If a save fails (or if only a partial save was made) due to lack of file system space, you have a
chance, once the system is running again, to clean up the file system in order to gain the space
you need for the savecrash operation; or you can run the savecrash command manually,
specifying an alternate destination for the saved data.
CAUTION: If you are using your devices for both paging and dumping, do not disable the savecrash
boot processing or you will lose the dumped memory image to subsequent system paging activity.
What to Do After the System Has Rebooted
After your system is rebooted, one of the first things you need to do is to be sure that the physical
memory image that was dumped to the dump devices is copied to the HP-UX file system area
so that you can either package it up and send it to an expert for analysis, or analyze it yourself
using a debugger.
NOTE: It is possible to analyze a crash dump directly from dump devices using a debugger
that supports this feature. But if you need to save it to removable media, or send it to someone,
you first need to copy the memory image to the HP-UX file system area.
Unless you specifically disable savecrash processing during reboot, the savecrash utility
will copy the memory image for you during the reboot process. The default HP-UX directory
that it will put the memory image in is /var/adm/crash. You can specify a different location
by editing the file /etc/rc.config.d/savecrash and setting the environment variable called
SAVECRASH_DIR to the name of the directory where you would like the dumps to be located.
Just be sure the destination has enough disk space to hold the copied memory image.
LiveDump (Memory Dumps of Running Systems)
Beginning with HP-UX 11i version 3, it is possible to perform dump processing on HP Integrity
servers without crashing the system and without causing instability in the system.
Live dumps (memory dumps of systems that have not crashed and are still running) can be
useful:
• For analyzing what caused some recoverable operating system faults
• In the event of failures with dynamically loadable kernel modules that do not destabilize
the kernel (for example, troubleshooting certain problems with I/O drivers)
• For debugging problems with system performance degradation
• For analyzing a snapshot of a running kernel off line.
Live dumps can be user initiated or kernel initiated. Users with appropriate privileges can initiate
a live dump using the livedump command (see livedump(1M) for details on how to do this).
LiveDump (Memory Dumps of Running Systems) 87