This is an archive of past FreeBSD releases; it's part of the FreeBSD Documentation Archive.
Contributed by Paul Richards <paul@FreeBSD.org> and
Jörg Wunsch <joerg@FreeBSD.org>
When running a development kernel (eg: FreeBSD-CURRENT), a kernel under extreme conditions (eg: very high load averages, tens of thousands of connections, exceedingly high number of concurrent users, hundreds of jail(8)s, etc.), or using a new feature or device driver on FreeBSD-STABLE (eg: PAE), sometimes a kernel will panic. In the event that it does, this chapter includes basic instructions for extracting useful information out of a crash.
A system reboot is inevitable once a kernel panics. Once a system is rebooted, the contents of a system's physical memory (RAM) is lost, as well as any bits that are on the swap device before the panic. To preserve the bits in physical memory, the kernel makes use of the swap device as a place to store the bits that are in physical memory that way when the system reboots, a kernel image can be extracted and debugging can take place.
Note: A swap device that has been configured as a dump device still acts as a swap device. Dumps to non-swap devices, tapes for example, are not supported at this time. A ``swap device'' is synonymous with a ``swap partition.''
To be able to extract a usable core, it is required that at least one swap partition be large enough to hold all of the bits in physical memory. When a kernel panics, before the system reboots, the kernel is smart enough to check to see if a swap device has been configured as a dump device. If there is a valid dump device, the kernel dumps the contents of what is in physical memory to the swap device (assuming the swap device is configured as a dump device).
Before the kernel will dump the contents of its physical memory to a dump device, a dump device must be configured. A dump device is specified by using the dumpon(8) command to tell the kernel where to save kernel crash dumps. The dumpon(8) program must be called after the swap partition has been configured with swapon(8). This is normally handled by setting the dumpdev variable in rc.conf(5) to the path of the swap device.
Alternatively, you can hard-code the dump device via the dump clause in the config line of your kernel configuration file. This approach is deprecated and should be used only if you want a crash dump from a kernel that crashes during booting.
Tip: Check /etc/fstab or swapinfo(8) for a list of swap devices.
Important: Make sure the dumpdir specified in rc.conf(5) exists before a kernel crash!
# mkdir /var/crash
Once a dump has been written to a dump device, the dump must be extracted before the swap device is mounted, otherwise the dump will be corrupted. To extract a dump from a dump device, use the savecore(8) program. If dumpdev has been set in rc.conf(5), savecore(8) will be called automatically on the first multi-user boot after the crash and before the swap device is mounted. The location of the extracted core is placed in the rc.conf(5) value dumpdir, by default /var/crash.
Tip: If you are testing a new kernel but need to boot a different one in order to get your system up and running again, boot it only into single user mode using the -s flag at the boot prompt, and then perform the following steps:
# fsck -p # mount -a -t ufs # make sure /var/crash is writable # savecore /var/crash /dev/ad0s1b # exit # exit to multi-userThis instructs savecore(8) to extract a kernel dump from /dev/ad0s1b and place the contents in /var/crash. Don't forget to make sure the destination directory /var/crash has enough space for the dump or to specify the correct path to your swap device as it is likely different than /dev/ad0s1b!
The recommended and certainly easiest way to automate obtaining crash dumps is to use the dumpdev variable in rc.conf(5).
This, and other documents, can be downloaded from ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.
For questions about FreeBSD, read the documentation before contacting <questions@FreeBSD.org>.
For questions about this documentation, e-mail <doc@FreeBSD.org>.