A crash dump is the image of the state of the kernel that was in
physical memory when the system failed. The physical memory (or core
file) is a snapshot of the kernel containing all of the program text,
data, and control structures that are part of the operating system.
When a system crashes, the physical memory is written to the end of the
swap slice of the disk. Although the system writes a core file whenever it crashes, it does not save the crash dump file unless you configure the system to do so.
How Crash Dumps Are Created
With crash dumps enabled, when you reboot a system after a crash, the savecore program runs. savecore preserves a copy of the crash dump by writing it from the end of the swap slice into the directory /var/crash/systemname, where systemname is the name of the system. savecore incrementally saves the core image in the file vmcore.n and the namelist for the kernel in the file, unix.n. The n suffix is incremented each time savecore is run. As a result, the /var/crash/systemname directory can grow quite large on a system that crashes repeatedly.
Before savecore writes out a core image, it tries to determine the amount of available space left in the file system by reading the minfree file in the /var/crash/systemname directory. The minfree
file contains a single ASCII number that represents the number of
kilobytes of free space that must remain available in the file system.
If saving the core file reduces the minimum free space to below the number in the /var/crash/systemname/minfree file, then savecore does not write out the crash dump. If the minfree file does not exist, savecore always writes out the core file, if one was created.
One way you can control the size of the /var/crash/systemname directory is to edit the minfree file and set the number large enough to prevent savecore from writing out the core file.
You can save a crash dump manually on a system with crash dumps disabled by running savecore as soon as the system has completed booting. If you do not run savecore immediately, the swap space containing the crash dump will be overwritten by programs. See the manual page for more information.
