Shorten the size of a kernel dump file

This document (7006319) is provided subject to the disclaimer at the end of this document.

Environment


SUSE Linux Enterprise Server 10 Service Pack 2
SUSE Linux Enterprise Server 10 Service Pack 3
SUSE Linux Enterprise Server 11

Situation

The dump level of a kernel can be specified in /etc/sysconfig/kdump with the option KDUMP_DUMPLEVEL. If the dump level is set to a level producing a large dump file, (0 produces the largest dump files, 31 the smallest), the dump file might become very large on systems with a lot of RAM.
If the dump file needs to be transfered somewhere else for analysis, the transfer or upload might take a very long time, and you may wish to reduce the size of the file.

Resolution

To get a stripped, smaller version of the original dump file you can run "makedumpfile" on the captured dump file and copy only pages necessary for analysis.

You need to install the kernel debuginfo RPM, matching the same kernel version and flavor of the kernel, the dump file was taken from. Then run makedumpfile specifying another dump level to produce a new smaller dump file. Here's an example of the command:

makedumpfile -d 15 -x /usr/lib/debug/boot/vmlinux-2.6.16.60-0.66.1-default.debug /var/log/dump/2010-06-21-13\:05/vmcore /tmp/shorter-vmcore

-d lets you specify the dump level. 15 is a good, recommended size, producing dump files, sufficient for analysis in most cases.

-x specifies the location of the vmlinux debug file. After the installation of the kernel debuginfo RPM, the vmlinux debug file (vmlinux-kernelversion-kernelflavor.debug) is located per default in /usr/lib/debug/boot. 

The vmlinux file is followed by the dump file location, specified in KDUMP_SAVEDIR. If saved on the disk, the default is /var/log/dump/date/.

The last parameter is the new, stripped down version of the dump file.

Additional Information

Please note that makedumpfile doesn't shorten the size on SLES11 SP1 when the dumpfile is in a "compressed" format.
The following error is displayed:
"check_elf_format: Can't get valid ehdr"
As temporary solution, makedumpfile from openSUSE 11.4 (makedumpfile-1.3.6-2.1) can be used to shorten the size.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7006319
  • Creation Date: 21-Jun-2010
  • Modified Date:03-Mar-2020
    • SUSE Linux Enterprise Server

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback@suse.com

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

Join Our Community

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.


SUSE Customer Support Quick Reference Guide SUSE Technical Support Handbook Update Advisories
Support FAQ

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.

Go to Customer Center
Report a Software Vulnerability Submit Tips, Tricks, and Tools Download Free Tools