Shulou(Shulou.com)06/01 Report--

This article mainly introduces "how to install Kdump on Ubuntu system to deal with system crash". In daily operation, I believe many people have doubts about how to install Kdump on Ubuntu system to deal with system crash. Xiaobian consulted all kinds of materials and sorted out simple and easy-to-use operation methods. I hope it will be helpful to answer the doubt of "how to install Kdump on Ubuntu system to deal with system crash". Next, please follow the editor to study!

What is Kdump?

Kdump is a new crash dump capture mechanism, which is used to capture crash dump generated during kernel crash. Kdump needs to be configured with two kernel for different purposes, one of which we call standard (production) kernel; here and the other Crash (capture) kernel.

Standard (production) kernel refers to the kernel I am using. When crash occurs in standard kernel, kdump will switch to crash kernel. To put it simply, crash will occur while standard kernel is running, and crash (capture) Kernel will be used to capture crash dump generated by production kernel crash.

The crash dump is captured in the context of the new crash (capture) kernel, not in the standard kernel context.

Specifically, when crash is in standard kernel mode, kdump automatically starts into crash kernel through kexec (described later). If the kdump service is started, standard kernel reserves some memory, which is used to start crash kernel.

The kdump mechanism mainly includes two components: kdump and kexec.

Kexec is a quick startup mechanism that allows you to start a Linux kernel through the context of a running kernel without going through BIOS. BIOS can consume a lot of time, especially large servers with a large number of peripherals. This method can save a lot of time for developers who often start the machine. Kexec is the key to the implementation of the kdump mechanism, which consists of two components: one is the kernel space system call kexec_load, which is responsible for loading the captured kernel (capture kernel or sencond kernel) to the specified address when the production kernel (production kernel or first kernel) is started. The second is the user space tool kexec-tools, which passes the address of the capture kernel to the production kernel, so that the address of the capture kernel can be found and run when the system crashes. No kexec, no kdump. First, kexec realized that one kernel could be started in another kernel, and then kdump had the opportunity to use its talents.

Kdump is an advanced kernel crash dump mechanism based on kexec. When the system crashes, kdump uses kexec to boot to the second kernel. The second kernel, usually called the capture kernel, starts with very little memory to capture the dump image. The first kernel reserves a portion of memory for the second kernel to boot. Because kdump uses kexec startup to capture the kernel, bypassing BIOS, the memory of the first kernel is preserved. This is the essence of kernel crash dumps. Kdump requires two kernels for different purposes, the production kernel and the capture kernel. The production kernel is the target for capturing kernel services. The capture kernel starts when the production kernel crashes and builds a microenvironment with the corresponding ramdisk to collect and dump the memory under the production kernel. Note that kdump reserves a certain amount of important memory at startup, in order to calculate the true minimum memory needed by the system, plus the amount of memory used by kdump, to determine the true minimum memory requirement.

The design differences between kexec and kdump:

Kexec is designed to overwrite the original kernel location with a new kernel, while KDUMP reserves a piece of memory to load the second kernel (and related data), and the second kernel runs in the same location after Crash (otherwise it won't achieve the relevant purpose), collecting memory information about the first kernel.

Let's start experimenting with kdump features:

Operating system: ubuntu 12.10 (3.5.0-17-generic)

Install kdump tools

The code is as follows:

Apt-get install kexec-tools crash

It was found that grub was modified during installation, and the following parameters were added to the boot kernel configuration (/ boot/grub/grub.cfg)

The code is as follows:

Crashker nel=384M-2G:64M,2G-:128M

Crashkernel is used to specify the size of the reserved memory, we can know that the size of the reserved area set by crashkernel for us is: if the memory is less than 384m, do not reserve memory; if the memory is greater than or equal to 384m but less than 2G, reserve 64m; if the memory is greater than 2G, reserve 128m.

Modify kdump configuration file (/ etc/default/kdump-tools)

The code is as follows:

USE_KDUMP=1

Download the dbgsym file. The modified file is used to disturb the kernel information.

The code is as follows:

Wagt 'http://ddebs.ubuntu.com/pool/main/l/linux/linux-image-3.5.0-17-generic-dbgsym_3.5.0-17.28_amd64.ddeb'

Dpkg-I linux-image-3.5.0-17-generic-dbgsym_3.5.0-17.28_amd64.ddeb

Restart the machine for the configuration to take effect.

Start kdump-tools

The code is as follows:

/ etc/init.d/kdump-tools start

Starting kdump-tools: setup_linux_vesafb: 1280x1024x32 @ d9800000 + 500000

* loaded kdump kernel

Kdump-tools configuration (kdump-config show):

The code is as follows:

USE_KDUMP: 1

KDUMP_SYSCTL: kernel.panic_on_oops=1

KDUMP_COREDIR: / var/crash

Crashkernel addr: 0x2e000000

Current state: ready to kdump

Kernel link:

/ usr/lib/debug/boot/vmlinux-3.5.0-17-generic

Kexec command:

/ sbin/kexec-p-- command-line= "BOOT_IMAGE=/boot/vmlinuz-3.5.0-17-generic root=UUID=9386113e-a6db-4a1c-9565-8c8c1de4a55a ro irqpoll maxcpus=1 nousb"-- initrd=/boot/initrd.img-3.5.0-17-generic / boot/vmlinuz-3.5.0-17-generic

You can force a system crash through sysrq.

The code is as follows:

Echo'c'> / proc/sysrq-trigger

This causes the kernel to crash. If the configuration is valid, the system will restart into the kdump kernel. When the system process enters the point where the kdump service is started, (dump. The timestamp file will be copied to the location you set in the kdump configuration file. The default directory for ubuntu is the / var/crash/ timestamp folder. Then the system reboots into the normal kernel. Once you return to the normal kernel, you can find the dump file, the memory dump file, in the above directory. You can use the previously installed crash tool for analysis.

Directory structure of / var/crash after the dump file is generated:

├── 201305061817

│ ├── config_link-> / boot/config-3.5.0-17-generic

│ ├── dump.201305061817

│ ├── kernel_link-> / usr/lib/debug/boot/vmlinux-3.5.0-17-generic

│ └── system.map_link-> / boot/System.map-3.5.0-17-generic

├── config_link-> / boot/config-3.5.0-17-generic

├── kernel_link-> / usr/lib/debug/boot/vmlinux-3.5.0-17-generic

├── kexec_cmd

└── system.map_link-> / boot/System.map-3.5.0-17-generic

Ump.201305061817 is the generated dump file, followed by a string of numbers, ah, the timestamp at that time.

Next, use crash to analyze

The code is as follows:

Crash / usr/lib/debug/boot/vmlinux-3.5.0-17-generic dump.201305061817

The following error message appears: crash: cannot resolve: "xtime". At this time, the version of crash is 5.1.6. The version is too low to debug the 3.5 kernel. You need to upgrade crash. You can install crash manually.

At this point, the study on "how to install Kdump on a Ubuntu system to deal with system crash" is over. I hope to be able to solve your doubts. The collocation of theory and practice can better help you learn, go and try it! If you want to continue to learn more related knowledge, please continue to follow the website, the editor will continue to work hard to bring you more practical articles!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.