1

I want to practice with makedumpfile. However, it needs /proc/vmcore which is the memory image of the currently running kernel.

Also, reading the man page of makedumpfile, we also need 2 kernels: panicked kernel (crashed kernel) and capture kernel. Does this capture kernel run on the same machine or remotely?

1 Answer 1

4

The capture kernel runs on the same host. It runs in memory that the panic'd kernel reserved for the capture kernel to use. The capture kernel is started with the kexec mechanism by the panicing kernel.

/proc/vmcore should be provided by the kernel if its setup to export a memory image. If your kernel does not have a /proc/vmcore, then you're missing the right kernel infrastructure.

The linux kernel source implies that /proc/vmcore is only populated inside a capture kernel (the kernel command line providing the address of the panic'd kernels vmcore ELF header is required), so /proc/vmcore will exist in a regular kernel, but won't contain anything at all.

Inside the capture kernel, /proc/vmcore presents the crashed kernel as an ELF core image.

Here's some RH doc with more details: https://access.redhat.com/knowledge/solutions/6038

2
  • Thanks. Our system uses SLES (SUSE Linux Enterprise Server), and it generates vmcore. I just want to know how it is generated in a standard way. But since you mention this is kernel specific, I will look into the specific documents.
    – Amumu
    Jul 12, 2012 at 6:38
  • From the source (linux/fs/proc/vmcore.c) looks like /proc/vmcore only contains something "interesting" inside the capture kernel. In a regular kernel its empty. When /proc/vmcore is valid, the data is presented in ELF "core" file format.
    – P.T.
    Jul 12, 2012 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.