My original question is:
>Is there any simple command to dump the whole memory content of a system
>to a file similar to core dump of the system?
Many thanks to following replies, we have the following solutions
Law Hon Man <hmlaw@cse.cuhk.edu.hk>
"K.Ravi" <RAVKRISH.IN.ORACLE.COM.ofcmail@in.oracle.com>
Charles Gagnon <charles@Grafnetix.COM>
Glenn Satchell - Uniq Professional Services <Glenn.Satchell@uniq.com.au>
Solution A:
1) enable the savecore uncomment the following lines in
/etc/init.d/sysetup
#if [ ! -d /var/crash/`uname -n` ]
#then mkdir -m 0700 -p /var/crash/`uname -n`
#fi
# echo 'checking for crash dump...\c '
#savecore /var/crash/`uname -n`
# echo ''
2) use adb to crash the system
# adb -k -w /dev/ksyms /dev/mem
physmem 1e05
rootdir/X
rootdir:
rootdir: fc109408
rootdir/W 0 <--------------- set the vnode to be zero
rootdir: 0xfc109408 = 0x0
$q
#
The above example is from "Panic! Unix System Crash Dump Analysis" by Drake
and Brown.
Solution B:
just dd if=/dev/mem of=<file_name>
or
just view the memory content by crash -d /dev/mem
Solution C:
gcore of each process e.g.
# ps -ef | awk '{print $2}' | xargs -I {} -t gcore -o <path>/core {}
Regards,
Alan