Red Hat Enterprise Linux 5 Administration Unleashed

Saving Kernel Dumps for Analysis 437If no location is specified, the dump file is written to the /var/crash/ directory, whichmust exist on a mounted filesystem. The following alternate location types can be set in/etc/kdump.conf:21CAUTIONIf you modify the contents of /etc/kdump.conf after Kdump is already running, besure to enable the changes by executing the service kdump restart command.. Dedicated partition: The partition should be formatted but not mounted. The/var/crash// directory is created on the partition, and the core dump file iswritten to the directory. Multiple dump files can be written to the partition assumingit has enough disk space. Specify the filesystem type for the partition (acceptabletypes are ext2, ext3, vfat, msdos, and cramfs) as well as the partition device name,disk label, or UUID: Some examples include the following:ext3 /dev/sda5ext3 LABEL=kdumpvfat UUID=b97e45eb-6610-4a3b-ad27-6cab8e7f2faf. Raw disk partition: The partition should exist on the local system, but it should notbe formatted. When a crash occurs, the dump file is written to the raw partitionusing the dd utility. One more dump file can be written to the raw partition at atime. In kdump.conf, replace with the partition device name such as/dev/sda5:raw . NFS mounted filesystem: The NFS server must accept connections from the systemand allow the root user of the crashed system to write to it. The NFS share does nothave to be mounted. It will be mounted before attempting to write the dump file toit. If a hostname is used as the server name, the system must be able to resolve it toan IP address, or an IP address can be used.Each dump file is written to /var/crash/-/ in the specified NFSshared directory. The hostname of the crash system and the date are used in thedirectory path so that the server can store multiple dump files, assuming enoughdisk space is available. Replace the NFS server and directory name such asfileserver.example.com:/kdump:net :