{"id":22114,"date":"2026-11-12T08:00:00","date_gmt":"2026-11-12T07:00:00","guid":{"rendered":"https:\/\/webhosting.de\/?p=22114"},"modified":"2026-11-05T08:25:52","modified_gmt":"2026-11-05T07:25:52","slug":"analyzing-linux-crash-dumps-kdump","status":"publish","type":"post","link":"https:\/\/webhosting.de\/en\/linux-crash-dumps-kdump-analysieren\/","title":{"rendered":"Backing Up and Analyzing Linux Crash Dumps with kdump"},"content":{"rendered":"<div class=\"wh-article\" data-wh-layout=\"2.1.2\" style=\"width:100%;max-width:820px;margin:0 auto;color:#263b4b;font-family:inherit;font-size:18px;line-height:1.8;text-align:start;overflow-wrap:break-word;box-sizing:border-box\"><p class=\"wh-lead\" style=\"font-size:20px;line-height:1.7;color:#233746;margin:0 0 1.1em\">With kdump, you can configure a Linux server to capture a memory dump in the event of a specific kernel crash. For later analysis, you\u2019ll need the vmcore, a vmlinux file with debug information that matches the crashed kernel build, and a compatible crash tool.   The <strong style=\"font-weight:700;color:inherit\">Preparations Before the Crash<\/strong> is crucial: Without a reliable snapshot, the lost memory state cannot be reconstructed later. Even an existing dump is merely a snapshot; a single stack frame does not prove the cause.<\/p>\n<nav class=\"wh-toc\" aria-label=\"Contents of this article\" style=\"display:block;margin:28px 0 38px;padding:22px;border:1px solid #d9e4e8;border-radius:14px;background:#f4f8f8\"><p class=\"wh-toc-title\" style=\"font-size:13px;font-weight:700;letter-spacing:.08em;color:#49656b;margin:0 0 14px\">Go directly to the section<\/p><div class=\"wh-toc-grid\" style=\"display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,280px),1fr));gap:10px\"><div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#kdump-grundlagen\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">What kdump Captures During a Kernel Crash<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#voraussetzungen\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Requirements and Limitations of Data Collection<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#artefakte\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Which files are included in the analysis<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#vorbereitung-pruefen\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Preparing kdump on the server<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#sicherungsziel\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Select Backup Target and Dump Scope<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#crash-einstieg\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Open an existing vmcore file with crash<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#analyse-praxis\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Organizing Stacks and Storage Notes<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#fehlersuche\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">If there is no usable vmcore<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#betrieb-entscheidung\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Test Data Collection and Validate Results<\/a><\/div>\n<\/div><\/nav><section class=\"wh-section\" aria-labelledby=\"kdump-grundlagen\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"kdump-grundlagen\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">What kdump Captures During a Kernel Crash<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">kdump prepares to save a Linux kernel memory dump before a crash occurs. To do this, a memory region is reserved when the regular kernel starts. A separate <strong style=\"font-weight:700;color:inherit\">Capture Kernel<\/strong> loaded, which can be launched via kexec in the event of a suitable crash. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The capture kernel runs independently of the crashed system kernel and gains access to its memory image via <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">\/proc\/vmcore<\/code>. It can write this image to a configured destination. The saved file is usually called vmcore; whether it contains all of the original memory regions depends, among other things, on the selected filtering options. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The tasks are separate: kdump captures and saves the state, while the program <strong style=\"font-weight:700;color:inherit\">crash<\/strong> an existing dump is then analyzed. This allows you to examine kernel messages and task stacks, for example. A dump is a snapshot and does not automatically provide the complete history leading up to the error. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">A kernel oops is not the same as a kernel panic: An oops can occur without the system immediately going into a panic. Therefore, not every kernel failure results in a kdump. An application core dump, on the other hand, reflects the state of a process and is not a kernel vmcore.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">This preparation is crucial for the subsequent investigation. If no capture kernel was prepared at the time of the crash or if no image was saved, kdump will not be able to reconstruct the lost memory state later. In that case, existing logs and other diagnostic data retained after the reboot will serve as a starting point.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"voraussetzungen\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"voraussetzungen\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Requirements and Limitations of Data Collection<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">First, determine the server's distribution, version, and architecture. Package names, service management, boot configuration, and supported storage targets all depend on these factors. When setting up the server, use the documentation specific to this platform instead of combining commands from different distributions; hardware and installed drivers also affect the requirements.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The boot parameter <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">crashkernel<\/code> specifies the <strong style=\"font-weight:700;color:inherit\">Storage Reservation<\/strong> for crash capture. This area is not available for normal operation. A one-size-fits-all value is not reliable: Base your decision on the specifications for distribution, architecture, and specific hardware, and take into account the storage requirements of the capture system.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Reserved memory alone is not enough. The capture kernel must be loaded and able to reach the configured destination. To do this, the necessary drivers and components must be available in its environment; for a network destination, the connection and an accessible remote host are also prerequisites.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Plan for sufficient capacity at the destination to accommodate the expected images and their storage. The size of a dump depends, among other things, on the contents of the storage and the filtering. A full or unreachable destination can prevent the backup from completing, even if the reservation is set correctly. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Even a prepared installation is no guarantee of a usable dump. An \u201coops\u201d does not necessarily trigger a \u201cpanic\u201d; in the event of a complete power loss, the capture kernel can no longer function. Similarly, a severe hardware failure can prevent it from starting or from writing the image. The capture process and the target must therefore be considered separately from the actual cause of the error.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"artefakte\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"artefakte\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Which files are included in the analysis<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The dump file isn't the only thing that matters for the investigation. If possible, also save the associated kernel files and logs so that you can compare the system state at the time of the crash with the messages and changes. The following overview distinguishes the actual memory dump from the auxiliary files that enable its analysis.<\/p>\n<div class=\"wh-table-scroll\" tabindex=\"0\" role=\"region\" aria-label=\"Diagnostic Artifacts and Their Limitations\" style=\"width:100%;max-width:100%;overflow-x:auto;margin:28px 0;border:1px solid #dce5e9;border-radius:14px;background:#fff;box-shadow:0 10px 28px -16px rgba(24,47,60,.32);box-sizing:border-box\"><table style=\"width:100%;min-width:580px;border-collapse:separate;border-spacing:0;border:0;margin:0;font-size:15px;line-height:1.6;background:#fff\"><caption style=\"padding:20px;text-align:start;font-size:17px;line-height:1.5;font-weight:700;color:#173246;background:#fff\">Diagnostic Artifacts and Their Limitations<\/caption><thead><tr><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Artifact<\/th><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Content<\/th><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Benefit<\/th><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Restriction<\/th><\/tr><\/thead><tbody><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">vmcore<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Secured kernel memory image<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">The Basis of Dump Analysis<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Filtered sections may be missing<\/td><\/tr><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">vmlinux with debug information<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Kernel file containing symbols and debug information<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Assigns memory contents and functions to the kernel<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Must match the crashed build<\/td><\/tr><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Kernel Messages<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Kernel Messages Displayed<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Show events and notes leading up to the panic<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Not necessarily complete or causal<\/td><\/tr><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Capture Kernel Log<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Reports from the data collection phase<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Helps with backup issues<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Can only be used if created and retained<\/td><\/tr><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Module Debug Information<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Symbols and Debug Information for Modules<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Delve deeper into the analysis of the relevant drivers<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Must be compatible with the modules used<\/td><\/tr><\/tbody><\/table><\/div><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">This is particularly important <strong style=\"font-weight:700;color:inherit\">appropriate vmlinux<\/strong>: The architecture and exact kernel build must match those of the crashed system kernel. The kernel running after the reboot may be a different one. The output of <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">uname -r<\/code> on the newly started server is therefore not enough to select the correct file for the old dump. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Also, use a version of `crash` that is compatible with the kernel and dump format. If external or additional drivers are relevant, have their corresponding module files and debug information ready as well. If symbols are missing or required memory pages have been filtered out, the analysis may be limited; such gaps should be documented in the findings.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">A vmcore may contain confidential information from memory. Therefore, restrict access, secure the transmission, and establish retention and deletion policies. Before you forward a dump or supplementary logs to a support service, clarify the necessary authorization and the permissible scope.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"vorbereitung-pruefen\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"vorbereitung-pruefen\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Preparing kdump on the server<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The starting point is the server's distribution, version, and architecture. Check the documentation for your specific distribution to see which packages are required for kdump and loading the capture kernel, and how to set up the service. Instructions for different distributions are not interchangeable: package names, boot configuration, and verification tools may vary.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Part of the preparation is finding the right <strong style=\"font-weight:700;color:inherit\">Storage Reservation<\/strong> about the boot parameter <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">crashkernel<\/code>. Select the size and, if necessary, other settings according to the specifications for the specific platform and hardware. The reserved memory is not available to the system running normally; therefore, a universal size specification would be just as unhelpful as blindly copying settings from another server.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">After completing the platform-specific boot configuration and, if necessary, restarting the system, the following shell command displays the parameters of the currently running kernel. Look for the following in the output: <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">crashkernel<\/code>. An entry shows the setting that was passed, but does not confirm that a capture kernel has been loaded or that a backup was successful.<\/p>\n<div class=\"wh-code-window\" data-wh-code style=\"margin:28px 0 34px;border:1px solid #2c4656;border-radius:12px;overflow:hidden;background:#132a3b;box-shadow:0 9px 25px -13px rgba(15,35,55,.2)\"><div class=\"wh-code-toolbar\" style=\"display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between;gap:10px;padding:11px 16px;background:#223e50;color:#edf5fa;font-size:13px;line-height:1.5;font-weight:600\"><span>Terminal<\/span><button type=\"button\" class=\"wh-code-copy\" data-wh-copy hidden style=\"padding:6px 11px;border:1px solid #7893a1;border-radius:6px;background:transparent;color:#fff;font-size:12px;line-height:1.5;font-weight:600;cursor:pointer\">Copy code<\/button><span class=\"wh-copy-status\" aria-live=\"polite\"><\/span><span data-wh-copy-success hidden>Copied<\/span><span data-wh-copy-fallback hidden>Code highlighted\u2014please copy<\/span><\/div><pre class=\"wh-code\" data-no-translation translate=\"no\" style=\"display:block;margin:0;padding:20px;max-width:100%;overflow-x:auto;color:#edf5fa;background:#132a3b;font:14px\/1.75 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;white-space:pre;direction:ltr;text-align:left\"><code class=\"language-bash\" style=\"font:inherit;color:inherit;background:transparent;padding:0;border:0;white-space:inherit\">cat \/proc\/cmdline<\/code><\/pre><\/div><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">On RHEL 9, you can also check the status using the following command in the shell. On other distributions, use the verification method documented there. A positive <strong style=\"font-weight:700;color:inherit\">Status Message<\/strong> is an important indicator of readiness, but it does not replace a controlled test of the entire safety system. <\/p>\n<div class=\"wh-code-window\" data-wh-code style=\"margin:28px 0 34px;border:1px solid #2c4656;border-radius:12px;overflow:hidden;background:#132a3b;box-shadow:0 9px 25px -13px rgba(15,35,55,.2)\"><div class=\"wh-code-toolbar\" style=\"display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between;gap:10px;padding:11px 16px;background:#223e50;color:#edf5fa;font-size:13px;line-height:1.5;font-weight:600\"><span>Terminal<\/span><button type=\"button\" class=\"wh-code-copy\" data-wh-copy hidden style=\"padding:6px 11px;border:1px solid #7893a1;border-radius:6px;background:transparent;color:#fff;font-size:12px;line-height:1.5;font-weight:600;cursor:pointer\">Copy code<\/button><span class=\"wh-copy-status\" aria-live=\"polite\"><\/span><span data-wh-copy-success hidden>Copied<\/span><span data-wh-copy-fallback hidden>Code highlighted\u2014please copy<\/span><\/div><pre class=\"wh-code\" data-no-translation translate=\"no\" style=\"display:block;margin:0;padding:20px;max-width:100%;overflow-x:auto;color:#edf5fa;background:#132a3b;font:14px\/1.75 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;white-space:pre;direction:ltr;text-align:left\"><code class=\"language-bash\" style=\"font:inherit;color:inherit;background:transparent;padding:0;border:0;white-space:inherit\">kdumpctl status<\/code><\/pre><\/div><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Also, verify that the intended target and the necessary drivers are available in the capture system. Record the selected settings and the time of the check so that you can reassess them after kernel or infrastructure changes. You should verify specific settings for the actual target platform before deployment.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"sicherungsziel\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"sicherungsziel\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Select Backup Target and Dump Scope<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The <strong style=\"font-weight:700;color:inherit\">Hedging Objective<\/strong> must be accessible during the capture process and have sufficient free space. A local destination avoids the need for a network connection, but requires usable storage space on the server. Also keep in mind that multiple saved dumps and accompanying diagnostic files can take up space. <\/p>\n<figure class=\"wp-block-image size-large wh-figure\" aria-describedby=\"wh-caption-detail1\" style=\"display:block;float:none;clear:both;width:100%;max-width:760px;margin:34px auto 40px;border:1px solid #dae5e9;border-radius:14px;overflow:hidden;background:#f5f8fa;box-shadow:0 10px 28px -17px rgba(24,47,60,.28);box-sizing:border-box\"><div class=\"wh-figure-media\" style=\"display:block;background:#eef3f5;line-height:0\"><img loading=\"lazy\" width=\"800\" height=\"534\" src=\"https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kdump-lokales-sicherungsziel-9dfbe234-detail1-c39b701852-1024x683.webp\" class=\"wp-image-22125\" alt=\"An AI-generated stock image of an external storage drive on a used desktop, symbolizing a local backup destination.\" decoding=\"async\" srcset=\"https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kdump-lokales-sicherungsziel-9dfbe234-detail1-c39b701852-1024x683.webp 1024w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kdump-lokales-sicherungsziel-9dfbe234-detail1-c39b701852-300x200.webp 300w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kdump-lokales-sicherungsziel-9dfbe234-detail1-c39b701852-768x512.webp 768w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kdump-lokales-sicherungsziel-9dfbe234-detail1-c39b701852-18x12.webp 18w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kdump-lokales-sicherungsziel-9dfbe234-detail1-c39b701852.webp 1536w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" ><\/div><figcaption class=\"wh-caption\" id=\"wh-caption-detail1\" style=\"display:block;margin:0;padding:12px 18px 15px;border-top:1px solid #dce5e9;color:#506575;background:#f5f8fa;font-size:14px;line-height:1.55;text-align:start\">AI-generated stock image: Local dump destinations require sufficient usable storage and compatible components in the capture system.<\/figcaption><\/figure><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">In addition to local targets, RHEL 9 also supports network targets via NFS or SSH. This allows the file to be stored separately from the affected server; however, the network, the remote system, and the required components in the capture system must be functioning properly. Check the specific limitations of the actual RHEL configuration rather than assuming that accessibility during normal operation is the same as in the capture system. <\/p>\n<div class=\"wh-table-scroll\" tabindex=\"0\" role=\"region\" aria-label=\"Comparison of Backup Targets for kdump on RHEL 9\" style=\"width:100%;max-width:100%;overflow-x:auto;margin:28px 0;border:1px solid #dce5e9;border-radius:14px;background:#fff;box-shadow:0 10px 28px -16px rgba(24,47,60,.32);box-sizing:border-box\"><table style=\"width:100%;min-width:580px;border-collapse:separate;border-spacing:0;border:0;margin:0;font-size:15px;line-height:1.6;background:#fff\"><caption style=\"padding:20px;text-align:start;font-size:17px;line-height:1.5;font-weight:700;color:#173246;background:#fff\">Comparison of Backup Targets for kdump on RHEL 9<\/caption><thead><tr><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Goal<\/th><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Advantage<\/th><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Important Dependency<\/th><\/tr><\/thead><tbody><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Local<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">No network connection is required for writing<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Usable local storage and available storage components<\/td><\/tr><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">NFS<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Saving to a network destination<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">The network and the NFS server must be accessible<\/td><\/tr><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">SSH<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Transmission to a remote station<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">The network and the SSH remote host must be accessible<\/td><\/tr><\/tbody><\/table><\/div><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">With <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">makedumpfile<\/code> The image can be compressed and filtered by selected memory areas. <strong style=\"font-weight:700;color:inherit\">Filtering<\/strong> This can save storage space and reduce data transfer volume, but it removes pages that may be needed for a later investigation. Therefore, tailor the scope of the dump to the expected diagnosis and document the filters used; the smallest file is not necessarily the most useful.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">A vmcore may contain confidential information from memory. Therefore, restrict access, secure the transmission, and specify how long the files will be retained and when they will be deleted. Before sharing a vmcore with a support service, verify that you have the necessary authorization; this also applies to separately stored copies.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"crash-einstieg\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"crash-einstieg\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Open an existing vmcore file with crash<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">For post-incident analysis, you'll need the existing vmcore, one that matches the crashed kernel build and architecture <strong style=\"font-weight:700;color:inherit\">vmlinux with debug information<\/strong> as well as a version of `crash` that is compatible with the kernel and dump format. The kernel running after a reboot may be a different one; therefore, the version information alone does not reliably identify the crashed build.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The following command should be entered in the standard shell on the analysis system. Replace both paths with the actual file locations. The command opens an existing image for analysis; it neither creates a dump nor sets up kdump. <\/p>\n<div class=\"wh-code-window\" data-wh-code style=\"margin:28px 0 34px;border:1px solid #2c4656;border-radius:12px;overflow:hidden;background:#132a3b;box-shadow:0 9px 25px -13px rgba(15,35,55,.2)\"><div class=\"wh-code-toolbar\" style=\"display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between;gap:10px;padding:11px 16px;background:#223e50;color:#edf5fa;font-size:13px;line-height:1.5;font-weight:600\"><span>Terminal<\/span><button type=\"button\" class=\"wh-code-copy\" data-wh-copy hidden style=\"padding:6px 11px;border:1px solid #7893a1;border-radius:6px;background:transparent;color:#fff;font-size:12px;line-height:1.5;font-weight:600;cursor:pointer\">Copy code<\/button><span class=\"wh-copy-status\" aria-live=\"polite\"><\/span><span data-wh-copy-success hidden>Copied<\/span><span data-wh-copy-fallback hidden>Code highlighted\u2014please copy<\/span><\/div><pre class=\"wh-code\" data-no-translation translate=\"no\" style=\"display:block;margin:0;padding:20px;max-width:100%;overflow-x:auto;color:#edf5fa;background:#132a3b;font:14px\/1.75 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;white-space:pre;direction:ltr;text-align:left\"><code class=\"language-bash\" style=\"font:inherit;color:inherit;background:transparent;padding:0;border:0;white-space:inherit\">crash \/pfad\/zum\/passenden\/vmlinux \/pfad\/zum\/vmcore<\/code><\/pre><\/div><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">After a successful start, you'll work on <strong style=\"font-weight:700;color:inherit\">crash prompt<\/strong>, no longer in the normal shell. There, it displays <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">log<\/code> the available kernel messages. Start by looking for the panic message and the messages surrounding it; messages can provide a starting point, but they do not necessarily describe the complete cause. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">With <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">bt<\/code> you examine the stack of the current analysis context; <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">bt -a<\/code> Displays the stacks of the active tasks on the CPUs. Compare the call chains with the messages instead of treating a single frame as proof of fault. Depending on the state and scope of the dump, some information may be missing. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">In the same prompt, try <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">ps<\/code> in the task overview; <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">kmem -i<\/code> Provides general memory information. This snapshot alone does not prove the existence of a memory leak or identify its cause. If a module involved needs to be examined more closely, the corresponding module files and debug information may also be required.  <\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"analyse-praxis\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"analyse-praxis\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Organizing Stacks and Storage Notes<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">If a panic occurs after a driver change, first note the time, the kernel build that crashed, and the modules involved. Compare this information with the change log: Was only the driver updated, or was a new kernel installed at the same time? This will help you narrow down which changes are relevant to the investigation.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Then read along with <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">log<\/code> the available kernel messages and examine them using <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">bt<\/code> the stack of the current analysis context. <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">bt -a<\/code> supplements the view of the CPUs' active tasks. In addition to the panic message, make a note of any messages that preceded the panic; they may provide context for an error that becomes apparent later.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">A <strong style=\"font-weight:700;color:inherit\">Driver Frame<\/strong> A stack trace provides a starting point, but it is not proof of fault. For example, a previous memory corruption might not become apparent until it reaches a driver function. Therefore, check whether the messages, the modules involved, and the sequence of events all align before concluding that a change is the cause.<\/p>\n<figure class=\"wp-block-image size-large wh-figure\" aria-describedby=\"wh-caption-detail2\" style=\"display:block;float:none;clear:both;width:100%;max-width:760px;margin:34px auto 40px;border:1px solid #dae5e9;border-radius:14px;overflow:hidden;background:#f5f8fa;box-shadow:0 10px 28px -17px rgba(24,47,60,.28);box-sizing:border-box\"><div class=\"wh-figure-media\" style=\"display:block;background:#eef3f5;line-height:0\"><img loading=\"lazy\" width=\"800\" height=\"534\" src=\"https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kernel-stackframe-einordnen-9dfbe234-detail2-c5e8882cf5-1024x683.webp\" class=\"wp-image-22126\" alt=\"AI-generated illustration of a call chain consisting of overlapping strips with a highlighted stack frame.\" decoding=\"async\" srcset=\"https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kernel-stackframe-einordnen-9dfbe234-detail2-c5e8882cf5-1024x683.webp 1024w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kernel-stackframe-einordnen-9dfbe234-detail2-c5e8882cf5-300x200.webp 300w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kernel-stackframe-einordnen-9dfbe234-detail2-c5e8882cf5-768x512.webp 768w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kernel-stackframe-einordnen-9dfbe234-detail2-c5e8882cf5-18x12.webp 18w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/kernel-stackframe-einordnen-9dfbe234-detail2-c5e8882cf5.webp 1536w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" ><\/div><figcaption class=\"wh-caption\" id=\"wh-caption-detail2\" style=\"display:block;margin:0;padding:12px 18px 15px;border-top:1px solid #dce5e9;color:#506575;background:#f5f8fa;font-size:14px;line-height:1.55;text-align:start\">AI-generated illustration: An unusual stack trace is a starting point, but it does not yet prove the cause of the error.<\/figcaption><\/figure><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">If storage is suspected, it provides <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">kmem -i<\/code> An overview of memory information, to the extent that the dump and the tool provide it. Consider these values in conjunction with the kernel messages. A single value does not prove the existence of a memory leak or identify its cause; furthermore, memory pages may be missing due to filtering. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">To determine whether usage builds up over time, you'll need additional time series data. If you analyze CPU load separately, you can <a href=\"https:\/\/webhosting.de\/en\/linux-perf-tool-analyzing-cpu-bottlenecks-optimization-server-load-profiling\/\">CPU Profiling with the Linux Perf Tool<\/a> help. Such measurements supplement the crash dump, but do not replace the state recorded in it at the time of the crash.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"fehlersuche\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"fehlersuche\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">If there is no usable vmcore<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">After a system freeze followed by a reboot, you should first determine whether a panic actually occurred and whether a vmcore file was saved. A reboot alone does not confirm either of these. Look for messages from the relevant time period and check the configured storage location before concluding that a specific error occurred simply because a file is missing.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Examine the <strong style=\"font-weight:700;color:inherit\">Traceability Chain<\/strong> Separately: Was a capture kernel loaded for the affected boot, and was the event suitable for triggering a kdump? Not every \"oops\" leads to a panic. A complete power loss or a severe hardware failure can also prevent the capture kernel from starting or writing data. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Next, check the backup destination: Was it accessible, was there enough space available, and did the capture system include the necessary drivers and components? For a network destination, the connection and the remote host are additional dependencies. Under RHEL, the file <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">kexec-dmesg.log<\/code> Provide information about the data collection phase, if it has been created and saved. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">If there is no usable dump, previous logs or persistent console and kernel messages are important alternatives. However, these sources do not provide a complete memory image; the lost state cannot be reconstructed later using kdump.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">If reports or other observations indicate network problems, a supplementary <a href=\"https:\/\/webhosting.de\/en\/analyze-linux-softirq-utilization-performance-tuning-data-center\/\">Analysis of Linux SoftIRQ Utilization<\/a> help in classifying packet processing. It addresses a different issue than checking the dump destination and, on its own, does not indicate either a panic or the cause of a failed backup.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"betrieb-entscheidung\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"betrieb-entscheidung\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Test Data Collection and Validate Results<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Choose the scope of the dump based on the expected diagnostic question and the available resources. Compression and filtering can save storage space and reduce the volume of data transferred; however, removed memory pages will no longer be available for later analysis. Document this decision so that it remains clear during the analysis which data may be missing. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">A vmcore may contain confidential memory data. Therefore, establish policies for access, secure transmission, and retention periods, as well as for the storage of related debug files. Before sharing the data with a support service, clarify the required authorization and the intended handling of the data.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Check the setup again if the kernel, drivers, boot configuration, or backup infrastructure change. This includes the loaded capture kernel and the accessibility of the selected target. A positive status message is helpful, but it does not in itself indicate whether an analyzable dump will actually be generated under the current conditions. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><strong style=\"font-weight:700;color:inherit\">Warning:<\/strong> A controlled end-to-end test intentionally triggers a crash and may cause system restarts and data loss. Perform this test only in an approved test environment or during a scheduled maintenance window with data backup in place. Clarify responsibilities, impacts, and recovery procedures beforehand; a trigger command is intentionally not provided for this purpose. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">A meaningful <strong style=\"font-weight:700;color:inherit\">End-to-End Test<\/strong> Don't stop at the status check: Verify that the file has arrived at its intended destination and can be opened with the files corresponding to the recorded build. When debugging the server, document your findings, missing data, uncertainties, and the next steps in the verification process. Be sure to clearly distinguish between observed indications and causes that have not yet been confirmed.<\/p>\n<\/section><section class=\"wh-sources\" style=\"margin:40px 0 0;padding:24px 0 0;border-top:1px solid #dce5e9;color:#596b7b;font-size:14px;line-height:1.65\"><h2 style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Sources and Current State of Knowledge<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Status of the research: <time datetime=\"2026-11-04\">2026-11-04<\/time><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Research and documentation status: November 4, 2026. Distribution-specific examples refer to RHEL 9; check the settings for your own platform before use.<\/p><div class=\"wh-source-urls\"><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/docs.kernel.org\/admin-guide\/kdump\/kdump.html<\/span><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/docs.redhat.com\/en\/documentation\/red_hat_enterprise_linux\/9\/html\/managing_monitoring_and_updating_the_kernel\/analyzing-a-core-dump_assembly_managing-kernel-command-line-parameters-with-uki<\/span><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/docs.redhat.com\/en\/documentation\/red_hat_enterprise_linux\/9\/html-single\/managing_monitoring_and_updating_the_kernel\/index<\/span><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/crash-utility.github.io\/help_pages\/log.html<\/span><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/crash-utility.github.io\/help_pages\/bt.html<\/span><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/crash-utility.github.io\/help_pages\/kmem.html<\/span><\/p><\/div><\/section><\/div>","protected":false},"excerpt":{"rendered":"<p>kdump creates a memory dump when certain kernel crashes occur. Learn about the requirements and how to carefully analyze an existing vmcore file using crash.<\/p>","protected":false},"author":1,"featured_media":22124,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[922],"tags":[],"class_list":["post-22114","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technologie"],"acf":[],"_links":{"self":[{"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/posts\/22114","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/comments?post=22114"}],"version-history":[{"count":3,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/posts\/22114\/revisions"}],"predecessor-version":[{"id":22127,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/posts\/22114\/revisions\/22127"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/media\/22124"}],"wp:attachment":[{"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/media?parent=22114"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/categories?post=22114"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/tags?post=22114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}