Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to practice with makedumpfile. However, it needs /proc/vmcore which is the memory image of the currently running kernel.

Also, reading the man page of makedumpfile, we also need 2 kernels: panicked kernel (crashed kernel) and capture kernel. Does this capture kernel run on the same machine or remotely?

share|improve this question

migrated from stackoverflow.com Jun 23 '12 at 15:45

This question came from our site for professional and enthusiast programmers.

up vote 2 down vote accepted

The capture kernel runs on the same host. It runs in memory that the panic'd kernel reserved for the capture kernel to use. The capture kernel is started with the kexec mechanism by the panicing kernel.

/proc/vmcore should be provided by the kernel if its setup to export a memory image. If your kernel does not have a /proc/vmcore, then you're missing the right kernel infrastructure.

The linux kernel source implies that /proc/vmcore is only populated inside a capture kernel (the kernel command line providing the address of the panic'd kernels vmcore ELF header is required), so /proc/vmcore will exist in a regular kernel, but won't contain anything at all.

Inside the capture kernel, /proc/vmcore presents the crashed kernel as an ELF core image.

Here's some RH doc with more details: https://access.redhat.com/knowledge/solutions/6038

share|improve this answer
Thanks. Our system uses SLES (SUSE Linux Enterprise Server), and it generates vmcore. I just want to know how it is generated in a standard way. But since you mention this is kernel specific, I will look into the specific documents. – Amumu Jul 12 '12 at 6:38
From the source (linux/fs/proc/vmcore.c) looks like /proc/vmcore only contains something "interesting" inside the capture kernel. In a regular kernel its empty. When /proc/vmcore is valid, the data is presented in ELF "core" file format. – P.T. Jul 12 '12 at 17:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.