Post-mortem pfiles

(originally published on 19.03.2019, reviewed/rewritten on 30.03.2025, tested on Oracle Solaris 11.4 SRU 79)

There are two nice changes to the pfiles tool. Sometimes it’s really useful to know what files were open when a process threw a core dump. With Solaris 11.4 pfiles got the ability to work on such core files.

root@testbed:~# gcore 951
gcore: core.951 dumped
root@testbed:~# pfiles core.951 | head -n 11
951:    /usr/lib/inet/sendmail -bl -q15m
  Current rlimit: 65536 file descriptors
  Current umask: 022
   0: S_IFCHR mode:0666 dev:16379,0 ino:60293128 uid:0 gid:3 rdev:115,2
      O_RDONLY|O_LARGEFILE
      /devices/pseudo/mm@0:null
      offset:0
   1: S_IFCHR mode:0666 dev:16379,0 ino:60293128 uid:0 gid:3 rdev:115,2
      O_WRONLY|O_LARGEFILE
      /devices/pseudo/mm@0:null
      offset:0

The second change to the pfiles is how the tool gathers the information of a running process. Up to 11.3 the process was stopped for a short moment while pfiles collected the nescessary information. In Solaris 11.4 this small stop isn’t done any longer.