conf/118255: savecore never finding kernel core dumps (rcorder problem)

[Jeremy Chadwick]

>Number:         118255
>Category:       conf
>Synopsis:       savecore never finding kernel core dumps (rcorder problem)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Nov 26 02:30:01 UTC 2007
>Closed-Date:
>Last-Modified:
>Originator:     Jeremy Chadwick
>Release:        FreeBSD 6.3-PRERELEASE i386
>Organization:
>Environment:
System: FreeBSD eos.sc1.parodius.com 6.3-PRERELEASE FreeBSD 6.3-PRERELEASE #0: Wed Nov 7 13:14:24 PST 2007 root at eos.sc1.parodius.com:/usr/obj/usr/src/sys/EOS i386
>Description:
	One of our production systems has begun kernel panic'ing for reasons unknown;
	we're in the process of figuring out why that's happening.  On the other hand,
	none of our kernel panics (which are being written to disk when doing "panic"
	from DDB) are being dropped into /var/crash when savecore runs.

	Details of our configuration and what actually happens were posted to
	freebsd-stable.  It shows that a kernel core dump is indeed written to the
	correct device (/dev/ad0s1b), but savecore never detects the cores:

	http://lists.freebsd.org/pipermail/freebsd-stable/2007-November/038069.html
	http://lists.freebsd.org/pipermail/freebsd-stable/2007-November/038569.html

	I believe the problem is that /etc/rc.d/swap1 (which does `swapon -a`) is
	being called _before_ /etc/rc.d/savecore, thus clobbering/stomping over any
	core dumps that exist.  See the 2nd URL above for some additional details.

	I'm marking this serious/medium because people being able to get vmcore
	images after a kernel panic is important.  :-)
>How-To-Repeat:
	Set dumpdev and dumpdir in /etc/rc.conf, panic system, and see.
>Fix:
	I believe the issue can be fixed by adjusting some of the rcorder(8) values
	so that savecore gets run *before* swap1. I'm not familiar with what needs to
	be changed to make this work.

>Release-Note:
>Audit-Trail:
>Unformatted: