Red Hat Enterprise Linux 5 Administration Unleashed

Saving Kernel Dumps for Analysis 433TABLE 21.2KeyrkbcosuptmvList of AltSysRq KeysDescriptionTurn off raw mode for the keyboard and turn on XLATE.Secure Access Key (SAK). Kill all programs on the current virtual console.Immediately reboot the system without syncing memory to disk or unmountingdisks. The command keys s and u to sync and remount all filesystems as read-onlyshould be attempted first.Perform a Kexec reboot so a crash dump can be taken.Shut down the system.Sync all mounted filesystems, if possible. Should be used before rebooting to tryand minimize data loss. When the sync is finished the OK and Done messages willappear.Remount all mounted filesystems as read-only, if possible.Display value of all current registers and flags to the console.Display current task list to the console.Display current memory information to the console.Display Voyager SMP processor information to the console.0-9 Set what type of kernel messages are displayed to the console, or the console loglevel. If set to 0, only emergency messages such as PANICs or OOPSes are printed.The higher the number, the more messages are printed.f Execute the OOM killer.e Terminate all processes except init with a SIGTERM signal.i Kill all processes except init with a SIGKILL signal.l Kill all processes including init with a SIGKILL signal, causing the system to benonfunctional.h Display help.21Saving Kernel Dumps for AnalysisWhen the kernel crashes, sometimes a snapshot, or “dump” of the system memory, canbe used to determine why the kernel crashes without having to reproduce the problem.Red Hat Enterprise Linux includes the Kdump utility to save the kernel dump. It replacesthe Netdump and Diskdump utilities from previous versions of Red Hat Enterprise Linux.The kernel dump file can be analyzed by the crash program after it is saved.Kdump has two major advantages over netdump and diskdump. First, the same programcan be used to save the kernel dump to a local file or over the network. Previously,diskdump had to be used to save to a local file and netdump had to be used to save overthe network. Second, Kdump uses Kexec to boot in to a second kernel without rebootingthe crashed kernel, thus giving you a better chance of capturing the dump file.Kdump and Kexec are features compiled into the kernel. However, the kexec-tools RPMpackage must also be installed because it includes the utilities to configure Kexec andKdump. On the ppc64 architecture only, the kernel-kdump RPM package is also required