Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

A.2. Creating Dump Files

You can request a dump of the core of a guest virtual machine to a file so that errors in the virtual machine can be diagnosed, for example by the crash utility.

Warning

In Red Hat Enterprise Linux 7.5 and later, the Kernel Address Space Randomization (KASLR) feature prevents guest dump files from being readable by crash. To fix this, add the <vmcoreinfo/> element to the <features> section of the XML configuration files of your guests.
Note, however, that migrating guests with <vmcoreinfo/> fails if the destination host is using an OS that does not support <vmcoreinfo/>. These include Red Hat Enterprise Linux 7.4 and earlier, as well as Red Hat Enterprise Linux 6.9 and earlier.

A.2.1. Creating virsh Dump Files

Executing the virsh dump command sends a request to dump the core of a guest virtual machine to a file so errors in the virtual machine can be diagnosed. Running this command may require you to manually ensure proper permissions on file and path specified by the argument corefilepath. The virsh dump command is similar to a core dump(or the crash utility).
For further information, see Creating a Dump File of a Guest Virtual Machine's Core.

A.2.2. Saving a Core Dump Using a Python Script

The dump-guest-memory.py python script implements a GNU Debugger (GDB) extension that extracts and saves a guest virtual machine's memory from the core dump after the qemu-kvm process crashes on a host. If the host-side QEMU process crash is related to guest actions, investigating the guest state at the time of the QEMU process crash could be useful.
The python script implements a GDB extension. This is a new command for the GDB. After opening the core dump file of the original (crashed) QEMU process with GDB, the python script can be loaded into GDB. The new command can then be executed from the GDB prompt. This extracts a guest memory dump from the QEMU core dumpto a new local file.
To use the dump-guest-memory.py python script:
  1. Install the qemu-kvm-debuginfo package on the system.
  2. Launch GDB, opening the core dump file saved for the crashed /usr/libexec/qemu-kvm binary. The debug symbols load automatically.
  3. Load the new command in GDB: 
    # source /usr/share/qemu-kvm/dump-guest-memory.py

    Note

    After loading the python script, the built-in GDB help command can provide detailed information about the dump-guest-memory extension.
  4. Run the command in GDB. For example: 
    # dump-guest-memory /home/user/extracted-vmcore X86_64
  5. Open /home/user/extracted-vmcore with the crash utility for guest kernel analysis.
For more information about extracting guest virtual machine cores from QEMU core files for use with the crash utility, see How to extract ELF cores from 'gcore' generated qemu core files for use with the 'crash' utility.