System Administration Guide
Appendix D, Using the crash(ADM) diagnostic tool

Defining the default dump device

Defining the default dump device

If your system crashes, it writes its memory image to the dump device. The default dump device is the swap area, /dev/swap, but you can define an alternative dump device in one of two ways:

If your system dumps its image to the swap area, it runs the dumpsave(ADM) command when it is next booted. This allows you to save the memory image to tape or floppy disk for later analysis.

NOTE: If you intend to analyze a memory image on a different system than the one that crashed, you must make a copy of the kernel program file that was running on the system that crashed. You cannot examine a memory image without this file -- crash needs it to access its symbol table.

If you also need to find out which files were open to processes at the time of the crash, you will also need to copy the contents of the filesystems.

The complementary command ldsysdump(ADM) copies a memory image from tape or floppy disk to a file:

/etc/ldsysdump filename

To check the validity of a memory image, you can use the memsize(ADM) command:

/etc/memsize filename

memsize returns an error if the memory image is corrupted.