Understanding kdump Configuration file /etc/kdump.conf

The configuration file for Kdump is /etc/kdump.conf. The default target location for the vmcore is the /var/crash directory on the local file system, which is represented as follows:

path /var/crash

To write to a different local directory, edit the path directive and provide the absolute path. Example:

path /

To write directly to a device, edit the raw directive and specify the device name. Example:

raw /dev/sda1

To write to a remote system by using NFS, use the nfs directive followed by the FQDN of the remote system, then a colon (:), and then the directory path. Example:

nfs host01.example.com:/export/crash

To write to a remote machine by using SSH, use the ssh directive followed by a valid username, the @ sign, and the host name, in that order. Example:

ssh root@host02.example.com

Modify the filtering level for the vmcore dump using the core_collector directive in the /etc/kdump.conf file. To exclude certain pages from the dump, use the -d [value] parameter where [value] is a sum of values of the pages that you want to exclude. Use the following values for the pages:

• 1: zero page
• 2: cache page
• 4: cache private
• 8: user data
• 16: user data

The recommendation is to exclude all these pages as follows. Add the values (the total for all is 31) and provide the sum as the argument to the -d (dump level) option:

core_collector makedumpfile -d 31 –c

The -c option enables dump file compression. To exclude only zero (1) and free (16) pages:

core_collector makedumpfile -d 17 –c

The default action to take if dumping to the intended target fails is to reboot. Other possible actions are halt, poweroff, shell, or dump_to_rootfs, which means dump vmcore to rootfs from initramfs context and reboot. To change this, set the default directive in /etc/kdump.conf, as in this example:

default poweroff