Chapter 8. Dumping a crashed kernel for later analysis
To analyze why a system crashed, you can use the
kdump service to save the contents of the system’s memory for later analysis. This section provides a brief introduction to
kdump, and information about configuring
kdump using the RHEL web console or using the corresponding RHEL system role.
8.1. What is kdump
kdump is a service which provides a crash dumping mechanism. The service enables you to save the contents of the system memory for analysis.
kdump uses the
kexec system call to boot into the second kernel (a capture kernel) without rebooting; and then captures the contents of the crashed kernel’s memory (a crash dump or a vmcore) and saves it into a file. The second kernel resides in a reserved part of the system memory.
A kernel crash dump can be the only information available in the event of a system failure (a critical bug). Therefore, operational
kdump is important in mission-critical environments. Red Hat advise that system administrators regularly update and test
kexec-tools in your normal kernel update cycle. This is especially important when new kernel features are implemented.
You can enable
kdump for all installed kernels on a machine or only for specified kernels. This is useful when there are multiple kernels used on a machine, some of which are stable enough that there is no concern that they could crash.
kdump is installed, a default
/etc/kdump.conf file is created. The file includes the default minimum
kdump configuration. You can edit this file to customize the
kdump configuration, but it is not required.
8.2. Configuring kdump memory usage and target location in web console
The procedure below shows you how to use the
Kernel Dump tab in the RHEL web console interface to configure the amount of memory that is reserved for the
kdump kernel. The procedure also describes how to specify the target location of the
vmcore dump file and how to test your configuration.
Kernel Dumptab and start the
kdumpmemory usage using the command line.
Click the link next to the
Crash dump locationoption.
Local Filesystemoption from the drop-down and specify the directory you want to save the dump in.
Alternatively, select the
Remote over SSHoption from the drop-down to send the vmcore to a remote machine using the SSH protocol.
ssh key, and
Directoryfields with the remote machine address, ssh key location, and a target directory.
Another choice is to select the
Remote over NFSoption from the drop-down and fill the
Mountfield to send the vmcore to a remote machine using the NFS protocol.Note
Compressioncheck box to reduce the size of the vmcore file.
Test your configuration by crashing the kernel.
In the Test kdump settings field, click
This step disrupts execution of the kernel and results in a system crash and loss of data.
8.3. kdump using RHEL System Roles
RHEL System Roles is a collection of Ansible roles and modules that provide a consistent configuration interface to remotely manage multiple RHEL systems. The
kdump role enables you to set basic kernel dump parameters on multiple systems.
kdump role replaces the
kdump configuration of the managed hosts entirely by replacing the
/etc/kdump.conf file. Additionally, if the
kdump role is applied, all previous
kdump settings are also replaced, even if they are not specified by the role variables, by replacing the
The following example playbook shows how to apply the
kdump system role to set the location of the crash dump files:
--- - hosts: kdump-test vars: kdump_path: /var/crash roles: - rhel-system-roles.kdump
For a detailed reference on
kdump role variables, install the
rhel-system-roles package, and see the
README.html files in the