savecrash - save a crash dump of the operating system
/sbin/savecrash [-cflprvzZ] [-D dumpdevice -O offset] [-d sysfile]
[-m minfree] [-s chunksize] [-t tapedevice]
[-w NOSWAP|SWAPEACH|SWAPEND] [dirname]
savecrash saves the crash dump information of the system (assuming one
was made when the system crashed) and writes a reboot message in the
shutdown log file.
dirname is the name of the existing directory in which to store the
crash dump; the default is /var/adm/crash.
savecrash saves the crash image and related files in the directory
dirname/crash.n. The trailing n in the directory name is a number
that increases by one every time savecrash is run with the same
dirname. This number is kept in the file dirname/bounds, which is
created if it does not already exist.
Usually, savecrash creates the INDEX file in the crash directory from
the crash dump header, copies all kernel modules that were loaded in
memory at the time of the crash, and copies all dump device contents
into crash image files.
When savecrash writes out a crash dump directory, it checks the space
available on the file system containing dirname. savecrash will not
use that portion of the file system space which is reserved for the
superuser. Additional space on the file system can be reserved for
other uses with -m minfree, where minfree is the amount of additional
space to reserve. This option is useful for ensuring enough file
system space for normal system activities after a panic.
If there is insufficient space in the file system for the portions of
the crash dump that need to be saved, savecrash will save as much as
will fit in the available space. (Priority is given to the index
file, then to the kernel module files, and then to the physical memory
image.) The dump will be considered saved, and savecrash will not
attempt to save it again, unless there was insufficient space for any
of the physical memory image. (See the description of option -r.)
savecrash also writes a reboot message in the shutdown log file
(/etc/shutdownlog), if one exists. (If a shutdown log file does not
exist, savecrash does not create one.) If the system crashes as a
result of a kernel panic, savecrash also records the panic string in
the shutdown log.
Hewlett-Packard Company - 1 - HP-UX Release 11i: November 2000
By default, when the primary paging device is not used as one of the
dump devices or after the crash image on the primary paging device has
been saved, savecrash runs in the background. This reduces system
boot-up time by allowing the system to be run with only the primary
It is possible for dump devices to be used also as paging devices. If
savecrash determines that a dump device is already enabled for paging,
and that paging activity has already taken place on that device, a
warning message will indicate that the dump may be invalid. If a dump
device has not already been enabled for paging, savecrash prevents
paging from being enabled to the device by creating the file
/etc/savecore.LCK. swapon does not enable the device for paging if
the device is locked in /etc/savecore.LCK (see swapon(1M) for more
details). As savecrash finishes saving the image from each dump
device, it updates the /etc/savecore.LCK file and optionally executes
swapon to enable paging on the device.
-c Mark the dump in the dump device as saved, without performing
any other action. The -c option is useful for manually
inhibiting dump actions called by /sbin/init.d/savecrash.
-f Run savecrash in the foreground only. By default, savecrash
runs in the background when the primary paging device does not
contain an unsaved portion of the crash image. Turning this
option on increases system boot-up time, but guarantees that
the dump has been saved when control returns to the caller.
-l Logs the panic information to /etc/shutdownlog as described
above, but does not actually save the dump. The dump is
marked as saved so that future invocations of savecrash do not
create duplicate log entries.
-p Only preserves swap-endangered dump device contents into crash
image files. Swap-endangered dump devices are those devices
that are also configured as swap devices by the system. If
all dump devices are configured as swap devices, the entire
dump will be preserved in the crash directory. If no swap
devices are used as dump devices (dedicated dump devices),
only the INDEX file and kernel modules will be copied into the
-r Resaves a dump that a previous invocation of savecrash has
marked as already saved. This is useful if the first
invocation did ran out of space, and enough space has since
been freed to try again.
-v Enables additional progress messages and diagnostics.
Hewlett-Packard Company - 2 - HP-UX Release 11i: November 2000
-z savecrash will compress all physical memory image files and
kernel module files in the dump directory.
-Z savecrash will not compress any files in the dump directory.
If neither -z nor -Z is specified and the amount of free disk
space becomes less than twice the total disk space, savecrash
will compress the remaining files.
dumpdevice is the name of the device containing the header of
the raw crash image. The console messages from the time of
the panic will identify the major and minor numbers of this
device. This option, in combination with -O, can be used to
tell savecrash where to find the dump in the rare instances
that savecrash doesn't know where to look.
offset is the offset in kBytes, relative to the beginning of
the device specified with -D above, of the header of the raw
crash image. The console messages from the time of the panic
will identify this offset. This option, in combination with
-D, can be used to tell savecrash where to find the dump in
the rare instances that savecrash doesn't know where to look.
sysfile is the name of a file containing the image of the
system that produced the core dump (that is, the system
running when the crash occurred). If this option is not
specified, savecrash gets the file name from the dump itself.
If the file containing the image of the system that caused the
crash has changed, use this option to specify the new file
minfree is the amount of free space (in kBytes) that must
remain free for ordinary user files after savecrash completes,
in addition to space reserved for the superuser. If
necessary, only part of the dump will be saved to achieve this
requirement. minfree may be specified in bytes (b), kilobytes
(k), megabytes (m), or gigabytes (g). The default minfree
value is zero, and the default unit is kilobytes.
chunksize is the size (default kBytes) of a single physical
memory image file before compression. The kByte value must be
a multiple of page size (divisible by 4) and between 64 and
1048576. chunksize may be specified in units of bytes (b),
kilobytes (k), megabytes (m), or gigabytes (g). Larger
numbers increase compression efficiency at the expense of both
savecrash time and debugging time. If -s is not specified, a
Hewlett-Packard Company - 3 - HP-UX Release 11i: November 2000
default is chosen based on the physical memory size and the
amount of available file system space.
tapedevice is the tape device where the crash dump will be
written. Crash dumps that are written to tape are written
using a tar format. The crash dump tape can be read using
When the -t option is specified, the -p option is not allowed
and the whole dump is always preserved. In addition, -c and
-l, are not allowed and -m is ignored. Also, when -t is
specified, savecrash will not perform any compression.
When dirname is specified with the -t option, dirname is the
name of the existing directory where the INDEX file is
created; the default directory is /tmp. The INDEX file is the
first file that is written out to the dump tape. This file is
written a second time once all the dump files have been
written. The first copy of the file only contains crash dump
header information and its filename on tape is tmpindex. It
does not contain information for the module and image files.
When writing to tape, the tape device must be online otherwise
the command will fail with an error. Additionally, when
savecrash reaches end-of-tape, it will prompt the user for the
next tape. Any tape errors encountered will result in a
generic tape error.
-w opt Defines the interaction between savecrash and swapon. opt can
be one of the following values:
NOSWAP Do not run swapon from savecrash.
SWAPEACH (default) Call swapon each time savecrash finishes
saving the image from each dump device. This
option provides the most efficient use of paging
SWAPEND Only call swapon when savecrash finishes saving
the image file from all dump devices. If this
option is used, no additional paging space other
than the primary paging space is available until
the complete crash dump image is saved. This
option provides a second chance to retrieve the
crash image if savecrash fails on first attempt.
For compatibility with earlier savecore syntax, the values of
0, 1 and 2 can be used in place of NOSWAP, SWAPEACH, and
SWAPEND, respectively. This usage is obsolescent.
Hewlett-Packard Company - 4 - HP-UX Release 11i: November 2000
Upon exit, savecrash returns the following values:
0 A crash dump was found and saved, or savecrash has preserved
dump information from the primary swap device and is
continuing to run in the background to complete its tasks.
1 A crash dump could not be saved due to an error.
2 No crash dump was found to save.
3 A partial crash dump was saved, but there was insufficient
space to preserve the complete dump.
4 The savecrash process continued in the background, see the
INDEX file for actual results.
savecrash relies on the expectation that device numbers have the same
meaning (point to the same devices) at the time the system dumps and
at the time the dump is saved. If, after a crash, the system was
booted from a different boot device in order to run savecrash, it is
possible that this expectation will not be met. If so, savecrash may
save an incomplete or incorrect dump or may fail to save a dump at
all. Such cases cannot be reliably detected, so there may be no
warning or error message.
If savecrash encounters an error while running in the background (such
as running out of space), it will not be easily detectable by the
caller. If the caller must ensure that the savecrash operation was
successful, for example before writing to a dump device, the caller
should specify -f to force savecrash to run in the foreground, and
should then examine the exit status of the savecrash process when it
savecrash was developed by HP and the University of California,
/etc/shutdownlog shutdown log
/etc/rc.config.d/savecrash savecrash startup
/sbin/init.d/savecrash savecrash startup file
dirname/bounds crash dump number
/stand/vmunix default kernel image saved by
adb(1), crashutil(1M), swapon(1M), tar(1).
Hewlett-Packard Company - 5 - HP-UX Release 11i: November 2000