Solaris

i had a situation where a process was defunct. preap would not reap the process and gcore would not work properly (not sure why). therefore, the suggestion was to force a panic and collect the core dump. obviously you could do a savecore -L and capture the dump without bringing down the system. However, I do realize that ram is still dynamic at that point and savecore does its best to capture the core at that time. half/reboot -d would give a much more accurate picture in the sense of time when savecore is ran.

my question is do you really see or can you see a big difference in the core dump doing say a reboot -d instead of savecore -L ?

gcore cannot work with a defunct process given the fact a dead process has nothing left in memory of its own.

good point. so even though the process is still in the process-table, all memory should have been cleared out for this process?

Indeed.