How to check if a kernel crash dump is set in Linux

Introduction

In this lab, you will learn how to check if the kernel crash dump mechanism, kdump, is set up and configured on a Linux system. We will begin by checking the current status of the kdump service using the kdumpctl status command.

Next, we will examine the main configuration file for kdump, located at /etc/kdump.conf, to understand its settings. Finally, we will inspect the crash-related settings within the /proc/sys/kernel directory to further verify the kernel's crash dump configuration.

Skills Graph

Check kdump status with kdumpctl status

In this step, we will learn how to check the status of kdump using the kdumpctl command. kdump is a feature in Linux that provides a crash dumping mechanism. When the system crashes, kdump captures the system memory and saves it to a file, which can then be used for debugging the cause of the crash.

The kdumpctl command is used to control the kdump service. We can use it to check if kdump is currently running and enabled.

Open your terminal. Remember, you can find the Xfce Terminal icon on the left side of your desktop.

Now, type the following command and press Enter:

kdumpctl status

This command will display the current status of the kdump service. The output will tell you if kdump is loaded, active, and enabled.

You should see output similar to this:

kdump is loaded
kexec: loaded
kdump: active
kdump: enabled

This output indicates that kdump is properly configured and running on your system.

If you see a different output, it might mean that kdump is not enabled or not running. For this lab, we assume kdump is enabled and active.

Understanding the status of kdump is the first step in managing crash dumps on a Linux system.

Click Continue to proceed to the next step.

Verify kdump config with cat /etc/kdump.conf

In this step, we will examine the main configuration file for kdump, which is located at /etc/kdump.conf. This file contains settings that control how kdump behaves when a system crash occurs, such as where to save the crash dump and what actions to take.

We will use the cat command to display the contents of this file. The cat command is a fundamental Linux utility used to concatenate and display file content.

Open your terminal if it's not already open.

Now, type the following command and press Enter:

cat /etc/kdump.conf

This command will print the entire content of the /etc/kdump.conf file to your terminal.

You will see several lines of configuration options. Some common options you might see include:

• path: Specifies the directory where crash dumps are saved.
• core_collector: Defines the program used to collect the crash dump (e.g., makedumpfile).
• crashkernel: Configures the amount of memory reserved for the kdump kernel.
• default: Sets the default action to take after a crash dump is saved (e.g., reboot).

Here is a snippet of what the output might look like (the exact content may vary slightly):

## This is a basic kdump configuration file.
#

#path /var/crash

#core_collector makedumpfile -l --message-level 1 -d 31
#core_collector_args -v --message-level 1 -d 31

#crashkernel 128M

#default reboot

Lines starting with # are comments and are ignored by the system. They often provide explanations for the configuration options.

By reviewing this file, you can understand how kdump is configured on your system. You can modify this file to change kdump's behavior, but be cautious when making changes to system configuration files.

Click Continue to move on to the next step.

Inspect crash settings in /proc/sys/kernel

In this step, we will explore some kernel parameters related to crashing and kdump within the /proc/sys/kernel directory. The /proc filesystem is a virtual filesystem that provides information about processes and other system information. The /proc/sys directory contains files that allow you to view and modify kernel parameters at runtime.

Specifically, we will look at files related to crash behavior. We can use the cat command again to view the contents of these files.

Open your terminal if it's not already open.

First, let's look at the panic file. This file controls the behavior of the kernel when a panic occurs (a severe, unrecoverable error). The value in this file represents the number of seconds the kernel will wait before rebooting after a panic.

Type the following command and press Enter:

cat /proc/sys/kernel/panic

You will see a single number as output, for example:

0

A value of 0 means the kernel will not automatically reboot after a panic. A positive value indicates the number of seconds to wait before rebooting.

Next, let's look at the panic_on_oops file. An "oops" is a less severe error than a panic, but it can still indicate a problem. This file determines whether an "oops" should trigger a full kernel panic.

Type the following command and press Enter:

cat /proc/sys/kernel/panic_on_oops

You will see either 0 or 1 as output:

1

A value of 0 means an "oops" will not cause a panic. A value of 1 means an "oops" will trigger a panic.

These kernel parameters are important for understanding how your system will react to errors and how kdump might be involved in capturing crash information.

Click Continue to complete this lab.

Summary

In this lab, we learned how to check if the kernel crash dump mechanism, kdump, is set up and running on a Linux system. We began by using the kdumpctl status command to verify the current state of the kdump service, confirming if it is loaded, active, and enabled. This provides a quick overview of kdump's operational status.

Following the status check, we examined the main configuration file for kdump, located at /etc/kdump.conf, using the cat command. This step allows us to inspect the specific settings that govern kdump's behavior during a system crash, such as the dump location and post-crash actions. Understanding the contents of this file is crucial for configuring and troubleshooting kdump.