Jump to content

kdump (Linux)

From Wikipedia, the free encyclopedia

kdumpis a feature of theLinux kernelthat createscrash dumpsin the event of akernel crash.When triggered, kdump exports a memory image (also known asvmcore) that can be analyzed for the purposes ofdebuggingand determining the cause of a crash. The dumped image ofmain memory,exported as anExecutable and Linkable Format(ELF) object, can be accessed either directly through/proc/vmcoreduring the handling of a kernel crash, or it can be automatically saved to a locally accessiblefile system,to araw device,or to a remote system accessible overnetwork.[1][2]

Internals

[edit]
In a "dual kernel" layout, kdump uses kexec to boot another kernel and obtain a memory dump.[3]: 10 

In the event of a kernel crash, kdump preserves system consistency bybootinganotherLinuxkernel, which is known as thedump-capture kernel,and using it to export and save a memory dump. As a result, the system boots into a clean and reliable environment instead of relying on an already crashed kernel that may cause various issues, such as causing file systemcorruptionwhile writing a memory dump file. To implement this "dual kernel" layout, kdump useskexecfor "warm" booting into the dump-capture kernel immediately after the kernel crash, using kexec's ability to boot "over" the currently running kernel while avoiding the execution of abootloaderandhardwareinitialization performed by the systemfirmware(BIOSorUEFI). A dump-capture kernel can be either a separate Linuxkernel imagebuilt specifically for that purpose, or the primary kernel image can be reused onarchitecturesthat supportrelocatablekernels.[1][3][4][5]: 5–6 

The contents of main memory (RAM) are preserved while booting into and running the dump-capture kernel by reserving a small amount of RAM in advance, into which the dump-capture kernel is preloaded so none of the RAM used by the primary kernel is overwritten when a kernel crash is handled. This reserved amount of RAM is used solely by the dump-capture kernel and is otherwise unused during normal system operation. Some architectures, includingx86andppc64,require a small fixed-position portion of RAM to boot a kernel regardless of where it is loaded; in this case, kexec creates a copy of that portion of RAM so it is also accessible to the dump-capture kernel. Size and optional position of the reserved portion of RAM are specified through thekernel boot parametercrashkernel,and thekexeccommand-line utilityis used after the primary kernel boots to preload a dump-capture kernel image and its associatedinitrdimage into the reserved portion of RAM.[1][3][4]

In addition to the functionality that is part of the Linux kernel, additionaluserspaceutilities support the kdump mechanism, including thekexecutility mentioned above.[1][4]Besides the official utilities, which are provided as apatchto the kexec's suite of userspace utilities, someLinux distributionsprovide additional utilities that simplify the configuration of kdump's operation, including the setup of automated saving of memory dump files.[6][7][8]Created memory dump files can be analyzed using theGNU Debugger(gdb), or by usingRed Hat's dedicatedcrashutility.[9][10]

History

[edit]

Kdump replaced the deprecated Linux Kernel Crash Dumps (LKCD) tool, which also wrote the contents of memory upon a crash.[11]Kdump presents a more efficient, scalable utility than LKCD.[12]

kdump functionality, together with kexec, was merged into theLinux kernel mainlinein kernel version 2.6.13, which was released on August 29, 2005.[13]

See also

[edit]
  • debugfs– a Linux kernel's RAM-based file system specifically designed for debugging purposes
  • kdump (BSD)– a BSD utility for viewing trace files generated by the ktrace utility
  • Linux kernel oops– a potentially non-fatal deviation from correct behavior of the Linux kernel
  • ProcDump– a utility for creating core dumps of applications based on performance triggers

References

[edit]
  1. ^abcdJonathan Corbet (October 27, 2004)."Crash dumps with kexec".LWN.net.RetrievedAugust 9,2014.
  2. ^"13.2 About Kdump (Chapter 13: Support Diagnostic Tools)".Oracle Corporation.2012.RetrievedAugust 9,2014.
  3. ^abcVivek Goyal; Eric W. Biederman; Hariprasad Nellitheertha (June 14, 2006)."Kdump: A Kexec-based Kernel Crash Dumping Mechanism"(PDF).lse.sourceforge.net.RetrievedAugust 9,2014.
  4. ^abc"Linux kernel documentation: Documentation/kdump/kdump.txt".kernel.org.August 12, 2013.RetrievedAugust 9,2014.
  5. ^Takashi Iwai (July 26, 2006)."Debugging using Kdump"(PDF).SUSE.RetrievedAugust 9,2014.
  6. ^"29.2.2. Using the Kernel Dump Configuration Utility (Red Hat Enterprise Linux 6 Deployment Guide)".Red Hat.RetrievedAugust 9,2014.
  7. ^"kexec and kdump: Basic kdump Configuration (System Analysis and Tuning Guide)".SUSE.April 25, 2014.RetrievedAugust 9,2014.
  8. ^"How to use kdump to debug kernel crashes".Fedora.April 9, 2014.RetrievedAugust 9,2014.
  9. ^David Anderson (August 27, 2010)."White Paper: Red Hat Crash Utility".Red Hat.RetrievedAugust 9,2014.
  10. ^"kexec and kdump: Analyzing the Crash Dump (System Analysis and Tuning Guide)".SUSE.April 25, 2014.RetrievedAugust 9,2014.
  11. ^Ljubuncic, Igor (April 15, 2009)."Collecting and analyzing Linux kernel crashes - LKCD".
  12. ^Ljubuncic, Igor (July 18, 2009)."Collecting and analyzing Linux kernel crashes - Kdump".
  13. ^"Linux kernel 2.6.13".kernelnewbies.org.August 29, 2005.RetrievedAugust 9,2014.
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Kdump_(Linux)&oldid=1236931859"