| Infodoc ID |
|
Synopsis |
|
Date |
| 14172 |
|
Why is a corefile created at bootup when the system has not crashed? |
|
3 Jan 2000 |
Why does the system generate a corefile each time it boots, even when it is
shut down normally?
Corefile generation is a two-stage process:
1. A copy of the kernel memory is written out to the primary swap area
when the system goes down with a panic.
2. The memory copy is then "salvaged" from swap and saved out to
a non-swap filesystem in a format that is usable for debugging
by a program called savecore when the system reboots.
The system saves a copy of its kernel memory at the far end of the
primary swap area as it goes down with a panic. It assumes that very
little swap, if any, will be needed at boot time, so the corefile, if
written at the other end, will not be overwritten until after it is
examined by the savecore program during boot (run from the
/etc/rc2.d/S20sysetup script. In 2.7 and newer it is enabled
automatically - see the man page for dumpadm(1M) for details).
When savecore runs at boot time it examines the primary swap area
and if there are specific tokens or magic numbers that mark the beginning
and end of a valid kernel core file it will save it out to disk. It does
this by examining the last block of the swap area and comparing it to the
block that would be the first block of the memory copy. If they match,
savecore assumes there is a corefile to be generated; if they differ or
do not make sense then savecore assumes that the system was brought down
normally. A system shut down normally will have only swap information,
of which each block will differ and there will be no corefile.
It is possible for a system with a lot of swap and main memory to
run without overwriting the portion of the swap file that has an intact
coredump. When these systems are shut down normally and rebooted (if there
was a previous panic and kernel core file), savecore may still detect
the intact coredump and generate a corefile.
If savecore attempts to generate a corefile on every reboot or if
it continues to tell you that a dump exists on your dump device you
might consider overwriting your swap partition by dd'ing or cp'ing
a large file (or /dev/zero) to it while in single user mode or booted
from cdrom and then rebooting immediately to avoid problems.
Swap is not valid or saved across reboots so the contents of it are
irrelevant and whatever was copied to it is meaningless (unless, as
discussed above, savecore detects the magic numbers indicating a kernel
core file).
Top
Sun Proprietary/Confidential: Internal Use Only
