kdump is a kernel crash dumping mechanism that captures a memory image (vmcore) when the Linux kernel crashes, preserving system memory contents for analysis. If kdump fails to generate a memory image, use the kdumpctl readlog command to view the dump capture kernel boot logs and identify the root cause. The kdumpctl tool is pre-installed on Alibaba Cloud Linux 3.
Prerequisites
Before you begin, ensure that you have:
An Elastic Compute Service (ECS) instance with more than 2 GB of memory
Alibaba Cloud Linux 3 or Anolis OS 8 with kernel version 5.10.134-14 or later
kexec-tools version 2.0.25.0.2 or later
View boot logs for a kernel crash dump
Step 1: Check kdump status
Run the following command to check whether kdump is running:
sudo kdumpctl statusIf the output contains
kdump: Kdump is operational, kdump is running. Skip to Step 3.If the output contains
kdump: Kdump is not operational, proceed to Step 2 to start kdump.
Step 2: Start kdump
sudo kdumpctl startThe following output confirms that kdump has started:
kdump: kexec: loaded kdump kernel
kdump: Starting kdump: [OK]Step 3: Trigger a kernel crash
Skip this step if a kernel crash has already occurred since the last time the operating system was restarted.
Running the following command immediately crashes the kernel, causing system exceptions or service interruptions. Do not run this command in a production environment or on any system with active workloads.
echo c | sudo tee /proc/sysrq-triggerAfter the kernel crashes, the Linux terminal simulator you are using cannot communicate with the ECS instance. Reconnect to the ECS instance to continue.
Step 4: View the boot logs
Run sudo kdumpctl readlog only after a crash-triggered kernel restart, not after a normal system restart. Boot logs are stored in memory and are cleared on a full system restart.
sudo kdumpctl readlogThe output contains two sections:
console log: kernel messages from the dump capture kernel boot sequence
ttylog: system service startup messages from the initramfs environment
Example output:
console log:
[ 0.000000] Linux version 5.10.134-17.2.al8.x86_64 (mockbuild@h87c01383.na61) (gcc (GCC) 10.2.1 20200825 (Alibaba 10.2.1-3.8 2.32), GNU ld version 2.35-12.3.al8) #1 SMP Fri Aug 9 15:49:42 CST 2024
[ 0.000000] Command line: BOOT_IMAGE=(hd0,gpt3)/boot/vmlinuz-5.10.134-17.2.al8.x86_64 ro rhgb cgroup.memory=nokmem spec_rstack_overflow=off vring_force_dma_api kfence.sample_interval=100 kfence.booting_max=0-2G:0,2G-32G:2M,32G-:32M preempt=none biosdevname=0 net.ifnames=0 console=tty0 console=ttyS0,115200n8 noibrs nvme_core.io_timeout=4294967295 nvme_core.admin_timeout=4294967295 cryptomgr.notests rcupdate.rcu_cpu_stall_timeout=300 vring_force_dma_api irqpoll nr_cpus=1 reset_devices cgroup_disable=memory mce=off numa=off udev.children-max=2 panic=10 rootflags=nofail acpi_no_memhotplug transparent_hugepage=never nokaslr novmcoredd hest_disable disable_cpu_apicid=0 ramoops.mem_address=0xaf000000 ramoops.mem_size=0x60000 ramoops.console_size=0x48000 ramoops.ttyprobe_size=0x10000 ramoops.ecc=0 ramoops.dump_oops=0 elfcorehdr=3063156K
[ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
[ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[ 0.000000] x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
.........
ttylog:
Welcome to Alibaba Cloud Linux 3.2104 U10 (OpenAnolis Edition) dracut-049-228.git20230802.0.1.al8 (Initramfs)!
[ OK ] Listening on udev Kernel Socket.
[ OK ] Reached target Timers.
[ OK ] Reached target Initrd Root Device.
[ OK ] Reached target Local File Systems.
[ OK ] Listening on Journal Socket.
[ OK ] Started Memstrack Anylazing Service.
[ OK ] Reached target Swap.
[ OK ] Listening on Journal Socket (/dev/log).
.........Use the console log section to diagnose dump capture kernel boot failures, and the ttylog section to identify which initramfs service failed to start.