Core Dumps
The full copy of memory image is called a core dump. This image can be useful for determining the cause of a crash. Core dumps are usually submitted to Cisco support engineers, who are specialized in analyzing the memory image (using source codes, memory maps, etc). The core dump can transfer the binary image file using TFTP, FTP, or RCP protocols (see Figure 4-7). You must remember that performing a core dump disrupts regular network operation.
){kind=link}
Figure 4-7 Creating Core Dump
If your router is malfunctioning, but has not crashed, use the write core command to generate a core dump without reloading. You must make sure that your server (TFTP, FTP, or RCP server) is reachable and has enough storage space. You must also learn the file-naming convention that the server's operating system supports. Finally, find out whether you need to create an empty file (with the desired name) on the server in advance.
The exception dump ip-address global configuration command (ip-address is the address of your TFTP, FTP, or RCP server) causes the router to attempt to produce a core dump when it crashes. By default, the core dump is written to a file named hostname-core on your server (hostname is the name of the router). If you want to change the name of the core file, the exception core-file filename command allows you do that.
Keep in mind that depending on the type of crash, this procedure does not always succeed. Finally, you need to be aware that using TFTP has a limitation. If you use TFTP to dump the core file to a server, the router will only dump the first 16 MB of its memory image (and if the router's memory is larger than 16 MB, part of the image will be missing). Hence, RCP or FTP is recommended to dump the core file for routers with larger than 16 MB of memory.