Accessing the dump

Edit online

After the kdump kernel has started, the dump can be accessed and copied from memory to a file on persistent storage. Typically, this process is automated through tools in an initial RAM disk that is provided with your distribution.

Before you begin

The user space in the kdump distribution initial RAM disk is typically set up to perform the following actions for you:

  1. Reading the dump of the production system
  2. Filtering and compressing the dump
  3. Saving the dump to a file on persistent storage
  4. Rebooting the production system

The steps that follow describe how to perform these tasks from the command line.

About this task

On the running kdump kernel, the dump can be accessed through two virtual files:
/proc/vmcore
represents the dump in Executable and Linkable Format (ELF) core format and includes memory, CPU register, and vmcoreinfo information.
/dev/oldmem
represents the dump in form of an unstructured linear memory.
The following description uses the more convenient ELF format at /proc/vmcore.

Procedure

  1. Optional: Use zgetdump to display information about the dump.
    # zgetdump -i /proc/vmcore
  2. Optional: Analyze the dump at /proc/vmcore with the crash tool, as usual. This means that you cannot IPL your production system until you have finished the analysis.
  3. Copy the dump to persistent storage.
    The following examples illustrate some of the options:
    This example copies the entire dump to a device that is available at /dumps/dump.elf in the Linux® file system:
    # cp /proc/vmcore /dumps/dump.elf
    This example uses scp to copy the entire dump to a file /dumps/dump.elf in the file system of another system, dumpstore:
    # scp /proc/vmcore user@dumpstore:/dumps/dump.elf
    This example uses makedumpfile to copy a compressed and filtered version of the dump to a file /dumps/dump.kdump in the Linux file system:
    # makedumpfile -c -d 31 /proc/vmcore /dumps/dump.kdump
    This example uses makedumpfile to copy a compressed and filtered version of the dump to a file /dumps/dump.kdump in the file system of another system, dumpstore:
    # makedumpfile -F -c -d 31 /proc/vmcore | \
ssh user@dumpstore "cat > /dumps/dump.kdump"
    The makedumpfile -c option compresses the dump, the -F option converts it to the flat format required for transferring the file, and -d filters unwanted data from the dump. The number that follows -d must be in the range 0 through 31. The number represents a bit mask that specifies which page types to filter out.

    For more details, see the man page for makedumpfile.

  4. Issue reboot, to start the production system again.

Results

You can now analyze the dump with crash.