Examining memory image of a crashed Sun system.

Assuming that the savecore function has been enabled and your system has successfully core dumped the Operating system to /var/crash/systemname you can acquire root cause of the system failure by performing the following steps:

• Cd to the system crash directory:

  cd /var/crash/systemname
      

• Use the general purpose debugger utility to examine the core files.

  adb -k unix.x vmcore.x - where x=the appropiate  number
      

• Issue the debugger command to display the panic string

  $<msgbuf
      

• Now quit out of the debugger utility.

  $q
      

• Issue the crash command to examine the time-frame of the crash crash vmcore.x unix.x

  >status
  >q
      

Other commands I have used to check core files (assuming core files with a number of 0 : unix.0 and vmcore.0) :

   strings vmcore.0           ---> most of us know this one
   echo 'msgbuf$<msgbuf' | adb -k unix.0 vmcore.0
   echo 'msgbuf,100/s' | adb -k unix.0 vmcore.0
   echo '$c' | adb -k unix.0 vmcore.0
   echo "<fp$<stackcalls" | adb -k unix.0 vmcore.0
   echo "<fp$<stack" | adb -k unix.0 vmcore.0
   echo "<fp$<stackregs" | adb -k unix.0 vmcore.0
   echo "<fp$<stacktrace" | adb -k unix.0 vmcore.0

   cd /var/crash/`uname -n`
   adb -k unix.0 vmcore.0
   *time-(*lbolt%0t100)=Y     ---> this is to confirm the time of the panic
   $> crashlog
   $< threadlist
   $>
   time/Y         ----> this is just to confirm that the threadlist has
   completed and properly responds to the time command
   <CTRL><D>

   cd /var/crash/`uname -n`
   crash -d vmcore.0 -n unix.0
   kmastat
   <CTRL><D>