Shorten the size of a kernel dump file
This document (7006319) is provided subject to the disclaimer at the end of this document.
Environment
SUSE Linux Enterprise Server 10 Service Pack 2
SUSE Linux Enterprise Server 10 Service Pack 3
SUSE Linux Enterprise Server 11
Situation
The dump level of a kernel can be specified in /etc/sysconfig/kdump with the option KDUMP_DUMPLEVEL. If the dump level is set to a level producing a large dump file, (0 produces the largest dump files, 31 the smallest), the dump file might become very large on systems with a lot of RAM.
If the dump file needs to be transfered somewhere else for analysis, the transfer or upload might take a very long time, and you may wish to reduce the size of the file.
If the dump file needs to be transfered somewhere else for analysis, the transfer or upload might take a very long time, and you may wish to reduce the size of the file.
Resolution
To get a stripped, smaller version of the original dump file you can run "makedumpfile" on the captured dump file and copy only pages necessary for analysis.
You need to install the kernel debuginfo RPM, matching the same kernel version and flavor of the kernel, the dump file was taken from. Then run makedumpfile specifying another dump level to produce a new smaller dump file. Here's an example of the command:
makedumpfile -d 15 -x /usr/lib/debug/boot/vmlinux-2.6.16.60-0.66.1-default.debug /var/log/dump/2010-06-21-13\:05/vmcore /tmp/shorter-vmcore
-d lets you specify the dump level. 15 is a good, recommended size, producing dump files, sufficient for analysis in most cases.
-x specifies the location of the vmlinux debug file. After the installation of the kernel debuginfo RPM, the vmlinux debug file (vmlinux-kernelversion-kernelflavor.debug) is located per default in /usr/lib/debug/boot.
The vmlinux file is followed by the dump file location, specified in KDUMP_SAVEDIR. If saved on the disk, the default is /var/log/dump/date/.
The last parameter is the new, stripped down version of the dump file.
You need to install the kernel debuginfo RPM, matching the same kernel version and flavor of the kernel, the dump file was taken from. Then run makedumpfile specifying another dump level to produce a new smaller dump file. Here's an example of the command:
makedumpfile -d 15 -x /usr/lib/debug/boot/vmlinux-2.6.16.60-0.66.1-default.debug /var/log/dump/2010-06-21-13\:05/vmcore /tmp/shorter-vmcore
-d lets you specify the dump level. 15 is a good, recommended size, producing dump files, sufficient for analysis in most cases.
-x specifies the location of the vmlinux debug file. After the installation of the kernel debuginfo RPM, the vmlinux debug file (vmlinux-kernelversion-kernelflavor.debug) is located per default in /usr/lib/debug/boot.
The vmlinux file is followed by the dump file location, specified in KDUMP_SAVEDIR. If saved on the disk, the default is /var/log/dump/date/.
The last parameter is the new, stripped down version of the dump file.
Additional Information
Please note that makedumpfile doesn't shorten the size on SLES11 SP1 when the dumpfile is in a "compressed" format.
The following error is displayed:
"check_elf_format: Can't get valid ehdr"
As temporary solution, makedumpfile from openSUSE 11.4 (makedumpfile-1.3.6-2.1) can be used to shorten the size.
The following error is displayed:
"check_elf_format: Can't get valid ehdr"
As temporary solution, makedumpfile from openSUSE 11.4 (makedumpfile-1.3.6-2.1) can be used to shorten the size.
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:7006319
- Creation Date: 21-Jun-2010
- Modified Date:03-Mar-2020
-
- SUSE Linux Enterprise Server
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback@suse.com
Run SAP
SUSE for Public Cloud
