how to enable linux box to dump crash image on local disk

[amit mehta]

>  You need to configure kdump  on  your RHEL system to enable it to dump the
> vmcore file when the panic happens... Kdump configuration is explained
> below.. There is a crashkernel boot parameter to be passed to kernel to
> specify the memory reserved for the crash kernel.
>
> http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/ch-kdump.html
>
> http://www.mindtwist.de/main/linux/11-red-hat/27-how-to-configure-kernel-dumps-on-rhel-5.html
>
> http://publib.boulder.ibm.com/infocenter/lnxinfo/v3r0m0/index.jsp?topic=/liaai/crashdump/liaaicrashdumpconfigkdump.htm
>
>
> Thanks and Regards,
> Sumeet


Thank you Sumeet for the link, I've enabled kdump on my machine by
following the steps mentioned
on the link above(http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/ch-kdump.html)
But it seems that there is some setup problem on my machine as
invoking "crash" is giving me an error.
see the logs below.

<<<snip from /etc/kdump.cfg>>>
#raw /dev/sda5
#ext4 /dev/sda2
#ext4 LABEL=/boot
#ext4 UUID=03138356-5e61-4ab3-b58e-27507ac41937
#net my.server.com:/export/tmp
#net user at my.server.com
path /var/crash
core_collector makedumpfile -c --message-level 1 -d 31
#core_collector cp --sparse=always
#link_delay 60
#kdump_post /var/crash/scripts/kdump-post.sh
#extra_bins /usr/bin/lftp
#disk_timeout 30
#extra_modules gfs2
#options modulename options
default halt
<<<snip from /etc/kdump.cfg>>>


[root at rhel6 boot]# mkinitrd /boot/initrd-2.6.32-71.el6.x86_64kdump.img
2.6.32-71.el6.x86_64

[root at rhel6 ~]# service kdump restart
Stopping kdump:                                            [  OK  ]
Your running kernel is using more than 70% of the amount of[WARNING]u
reserved for kdump, you should consider increasing your crashkernel
reservation
Starting kdump:                                            [  OK  ]

[root at rhel6 ~]# service kdump status
Kdump is operational

I hit the crash again and this time there was a vmcore under
/var/crash directory

[root at rhel6 2011-08-17-17:50]# pwd
/var/crash/2011-08-17-17:50

[root at rhel6 2011-08-17-17:50]# du -sh vmcore
43M	vmcore

These are the two debug rpms that i've installed for kernel symbols:
[root at rhel6 ~]# rpm -qa|grep -i debug
kernel-debuginfo-common-x86_64-2.6.32-71.7.1.el6.x86_64
kernel-debug-debuginfo-2.6.32-71.7.1.el6.x86_64

my production kernel, from which i've booted:
[root at rhel6 ~]# uname -r
2.6.32-71.el6.x86_64

[root at rhel6 ~]# crash -s
/usr/lib/debug/lib/modules/2.6.32-71.7.1.el6.x86_64.debug/vmlinux
/var/crash/2011-08-17-17\:50/vmcore
crash: invalid kernel virtual address: 7180  type: "possible"
WARNING: cannot read cpu_possible_map < - ----------------------------
crash: seek error: kernel virtual address: ffffffff8208e980  type: "xtime"


-Amit