Saving Kernel Dumps for Analysis

When the kernel crashes, sometimes a snapshot, or “dump” of the system memory, can be used to determine why the kernel crashes without having to reproduce the problem. Red Hat Enterprise Linux includes the Kdump utility to save the kernel dump. It replaces the Netdump and Diskdump utilities from previous versions of Red Hat Enterprise Linux. The kernel dump file can be analyzed by the crash program after it is saved.

Kdump has two major advantages over netdump and diskdump. First, the same program can be used to save the kernel dump to a local file or over the network. Previously, diskdump had to be used to save to a local file and netdump had to be used to save over the network. Second, Kdump uses Kexec to boot in to a second kernel without rebooting the crashed kernel, thus giving you a better chance of capturing the dump file.