This is something I get asked periodically: “When my system panicked, did it use deferred dump?”. Thankfully, the answer is easy if the console log is available:
If the dump was written to disk (“classic dump”), then the messages on the console will contain something like this:
Deferred dump not available.
dumping to /dev/zvol/dsk/rpool/dump, offset 65536, content: kernel sections: zfs
If the dump was preserved in memory (“deferred dump”), the console will contain this:
Preserving kernel image in RAM, content: kernel sections: zfs
Both of these messages should also find their way into the /var/adm/messages file. However, it is also possible to tell from the dump itself:
# echo “defdump_active/X” | mdb -k 1
defdump_active:
defdump_active: 1
A value of 1 here indicates deferred dump was used to generate this dump, and a value of 0 indicates it was not (i.e. classic dump via disk).