kdump (Linux)#History
{{Short description|Linux kernel's built-in crash dump mechanism}}
{{lowercase title}}
{{Use mdy dates|date=August 2014}}
kdump is a feature of the Linux kernel that creates crash dumps in the event of a kernel crash. When triggered, kdump exports a memory image (also known as vmcore) that can be analyzed for the purposes of debugging and determining the cause of a crash. The dumped image of main memory, exported as an Executable and Linkable Format (ELF) object, can be accessed either directly through {{Mono|/proc/vmcore}} during the handling of a kernel crash, or it can be automatically saved to a locally accessible file system, to a raw device, or to a remote system accessible over network.{{cite web
| url = https://lwn.net/Articles/108595/
| title = Crash dumps with kexec
| date = October 27, 2004
| access-date = August 9, 2014
| author = Jonathan Corbet
| publisher = LWN.net}}{{cite web
| url = http://docs.oracle.com/cd/E37670_01/E37355/html/ol_kdump_diag.html
| title = 13.2 About Kdump (Chapter 13: Support Diagnostic Tools)
| year = 2012
| access-date = August 9, 2014
| publisher = Oracle Corporation}}
{{Anchor|DUMP-CAPTURE-KERNEL|CRASH}}Internals
In the event of a kernel crash, kdump preserves system consistency by booting another Linux kernel, which is known as the dump-capture kernel, and using it to export and save a memory dump. As a result, the system boots into a clean and reliable environment instead of relying on an already crashed kernel that may cause various issues, such as causing file system corruption while writing a memory dump file. To implement this "dual kernel" layout, kdump uses kexec for "warm" booting into the dump-capture kernel immediately after the kernel crash, using kexec's ability to boot "over" the currently running kernel while avoiding the execution of a bootloader and hardware initialization performed by the system firmware (BIOS or UEFI). A dump-capture kernel can be either a separate Linux kernel image built specifically for that purpose, or the primary kernel image can be reused on architectures that support relocatable kernels.{{cite web
| url = http://lse.sourceforge.net/kdump/documentation/ols2005-kdump-presentation.pdf
| title = Kdump: A Kexec-based Kernel Crash Dumping Mechanism
| date = June 14, 2006
| access-date = August 9, 2014
| author1 = Vivek Goyal
| author2 = Eric W. Biederman
| author3 = Hariprasad Nellitheertha
| website = lse.sourceforge.net
| url = https://www.kernel.org/doc/Documentation/kdump/kdump.txt
| title = Linux kernel documentation: Documentation/kdump/kdump.txt
| date = August 12, 2013
| access-date = August 9, 2014
| publisher = kernel.org}}{{cite web
| url = http://ftp.suse.com/pub/people/tiwai/kdump-training/kdump-training.pdf
| title = Debugging using Kdump
| date = July 26, 2006
| access-date = August 9, 2014
| author = Takashi Iwai
| publisher = SUSE
}}{{rp|5–6}}
The contents of main memory (RAM) are preserved while booting into and running the dump-capture kernel by reserving a small amount of RAM in advance, into which the dump-capture kernel is preloaded so none of the RAM used by the primary kernel is overwritten when a kernel crash is handled. This reserved amount of RAM is used solely by the dump-capture kernel and is otherwise unused during normal system operation. Some architectures, including x86 and ppc64, require a small fixed-position portion of RAM to boot a kernel regardless of where it is loaded; in this case, kexec creates a copy of that portion of RAM so it is also accessible to the dump-capture kernel. Size and optional position of the reserved portion of RAM are specified through the kernel boot parameter {{Mono|crashkernel}}, and the {{Mono|kexec}} command-line utility is used after the primary kernel boots to preload a dump-capture kernel image and its associated initrd image into the reserved portion of RAM.
In addition to the functionality that is part of the Linux kernel, additional userspace utilities support the kdump mechanism, including the {{Mono|kexec}} utility mentioned above. Besides the official utilities, which are provided as a patch to the kexec's suite of userspace utilities, some Linux distributions provide additional utilities that simplify the configuration of kdump's operation, including the setup of automated saving of memory dump files.{{cite web
| url = https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/s2-kdump-configuration-gui.html
| title = 29.2.2. Using the Kernel Dump Configuration Utility (Red Hat Enterprise Linux 6 Deployment Guide)
| access-date = August 9, 2014
| publisher = Red Hat}}{{cite web
| url = https://www.suse.com/documentation/sles11/book_sle_tuning/data/cha_tuning_kdump_basic.html
| title = kexec and kdump: Basic kdump Configuration (System Analysis and Tuning Guide)
| date = April 25, 2014
| access-date = August 9, 2014
| publisher = SUSE}}{{cite web
| url = http://fedoraproject.org/wiki/How_to_use_kdump_to_debug_kernel_crashes
| title = How to use kdump to debug kernel crashes
| date = April 9, 2014
| access-date = August 9, 2014
| publisher = Fedora}} Created memory dump files can be analyzed using the GNU Debugger ({{Mono|gdb}}), or by using Red Hat's dedicated {{Mono|crash}} utility.{{cite web
| url = https://crash-utility.github.io/crash_whitepaper.html
| title = White Paper: Red Hat Crash Utility
| date = August 27, 2010
| access-date = August 9, 2014
| author = David Anderson
| publisher = Red Hat}}{{cite web
| url = https://www.suse.com/documentation/sles11/book_sle_tuning/data/cha_tuning_kdump_analyze.html
| title = kexec and kdump: Analyzing the Crash Dump (System Analysis and Tuning Guide)
| date = April 25, 2014
| access-date = August 9, 2014
| publisher = SUSE}}
History
Kdump replaced the deprecated Linux Kernel Crash Dumps (LKCD) tool, which also wrote the contents of memory upon a crash.{{cite web |url=https://www.dedoimedo.com/computers/lkcd.html |title= Collecting and analyzing Linux kernel crashes - LKCD |first=Igor |last=Ljubuncic |date=April 15, 2009}} Kdump presents a more efficient, scalable utility than LKCD.{{cite web |title=Collecting and analyzing Linux kernel crashes - Kdump |url=https://www.dedoimedo.com/computers/kdump.html |first=Igor |last=Ljubuncic |date=July 18, 2009}}
kdump functionality, together with kexec, was merged into the Linux kernel mainline in kernel version 2.6.13, which was released on August 29, 2005.{{cite web
| url = https://kernelnewbies.org/Linux_2_6_13
| title = Linux kernel 2.6.13
| date = August 29, 2005
| access-date = August 9, 2014
| website = kernelnewbies.org}}
See also
{{Portal|Linux}}
- debugfs{{snd}} a Linux kernel's RAM-based file system specifically designed for debugging purposes
- kdump (BSD){{snd}} a BSD utility for viewing trace files generated by the ktrace utility
- Linux kernel oops{{snd}} a potentially non-fatal deviation from correct behavior of the Linux kernel
- ProcDump{{snd}} a utility for creating core dumps of applications based on performance triggers
References
{{Reflist}}
External links
- {{Official website|lse.sourceforge.net/kdump/}}
- [http://lse.sourceforge.net/kdump/documentation/ols2oo5-kdump-paper.pdf Kdump, a Kexec-based Kernel Crash Dumping Mechanism], IBM, 2005, by Vivek Goyal, Eric W. Biederman, and Hariprasad Nellitheertha
- [https://opensource.com/article/17/6/kdump-usage-and-internals Using Kdump for examining Linux kernel crashes], June 21, 2017, by Pratyush Anand
- [https://events.static.linuxfound.org/sites/events/files/slides/kdump_usage_and_internals.pdf Kdump: Usage and internals], Red Hat, June 2017, by Pratyush Anand and Dave Young
{{Linux kernel}}
{{Operating system}}
Category:Free software programmed in C