How to configure Kdump in RHEL 7 / CentOS 7

In this tutorial i will show you how to install and setup the KDUMP in Redhat 7 / CentOS 7 for analysis

KDUMP is a kernel crash dump mechanism that is used to capture the crash dumps when the system crashes. 

If a system crashes with kdump enabled , kdump will invoke kexec to boot into second kernel,This second kernel resides in reserved part of the system memory and it is inaccessible to the first kernel

The second kernel main job is to capture the crash dump whenever the system crashes and these logs will be for finding the root cause why the system crashes.

Installation steps:

Step 1: Install the Kexec tools

yum -y install kexec-tools

Step 2: Configure the memory for kdump

To do this we need to edit the grub configuration file /etc/default/grub as root and search for the word GRUB_CMDLINE_LINUX and replace the "auto" option with the amount of memory you want to reserve

Step 3: Regenerate the Grub2 configuration

For BIOS firmware use the below command 

grub2-mkconfig -o /boot/grub2/grub.cfg

For UEFI firmware use the below command 

grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

Step 4:Configure the Dump location

If your system crashes, the core dump will be stored in the default location /var/cores, if you want to change you can edit the /etc/kdump.conf file as root and provide the required destination in the path location path /usr/local/cores  or you can provide the raw device or nfs location also.

eg: raw /dev/sdc1

Step 5 : Configure the core compression and action

To enable the compression edit the file /etc/kdump.conf as root and look for the core_collector makedumpfile -l --message-level 1 -d 31 and change it to core_collector makedumpfile -c 
where -c for compress

For changing the action search for the word default shell and change it to default reboot

Step 6 : Enabling the service

Start the service and also at boot time

systemctl start kdump.service

systemctl enable kdump.service

Step 7 : Crash the system

Check the service is active or dead and then proceed for crashing, if it is dead start and provide the below commands

echo 1 > /proc/sys/kernel/sysrq 

echo c > /proc/sysrq-trigger 

The above commands will crash the system immediately and after reboot , the dump file will be available under the location mentioned in kdump.conf

Step 8 : Install the crash

To know the exact root cause for the crash we need to analze the crash , for that crash and kernel-debuginfo package need to be installed and for debuginfo package we need to enable the repo Debuginfo.repo

yum -y install crash

debuginfo-install kernel

Step 9 : Analyse it

To start the crash utility use the command in the below format

crash /var/crash/<timestamp>/vmcore /usr/lib/debug/lib/modules/<kernel>/vmlinux

#crash /var/crash/127.0.0.1-2017-01-11-20:46:57/vmcore /usr/lib/debug/lib/modules/3.10.0-327.el7.x86_64/vmlinux