The savecore Utility

The savecore Utility

Your system does not automatically save the image of system memory at each system crash. When the system does store such an image, it is stored in a file called /var/adm/crash/vmcore.N, where N is a sequential number assigned to the most recent core file. The savecore command has a chkconfig option that can be turned on or off depending on your needs. Here is what happens under the two possible conditions:

savecore is on: The system saves the core dump. When the core dump has been saved, if a dump is successful, it will then run icrash on the core dumps that have been saved.
savecore is off: A core dump will not be saved by the system; however, icrash is still run on /unix and /dev/swap in order to get a report of what happened when the machine crashed. In this case, systems do not have to use the disk space on a core dump in order to get a report.

Two report files are created when icrash runs, with N being the bounds number for the core dump:

analysis.N: An analysis of the core dump is created containing items of interest, such as the putbuf dump, fru information, stack traces, and so on. This is a verbose description of what happened when the system crashed, and it is meant to be used to perform a preliminary analysis of the system before any hardware or software changes are made. See the icrash(1M) reference page for more information.
summary.N: The summary report contains the panic string, the crash time, and the fru information in one file for availmon. See the availmon(1M) reference page for more information.