When I use the SSH method to transfer a kdump vmcore, the resultant vmcore.flat file is unreadable by crash. What am I doing wrong and how can I fix this?

 00시 14분 2012년 3월 14일 업데이트

문제

A kdump core file vmcore.flat was captured via the SSH capture method. The core file cannot be read by the Crash analysis tool.

환경

  • Red Hat Enterprise Linux (RHEL) 5 and 6

해결

converting on RHEL 5

Run the following command against the file to rearrange the dump data vmcore.flat into a dumpfile /tmp/vmcore-rearranged readable by crash:

    /sbin/makedumpfile -R */tmp/vmcore-rearranged* < *vmcore.flat*

converting on RHEL 6

Run the following command against the file to rearrange the dump data vmcore.flat into a dumpfile /tmp/vmcore-rearranged readable by crash:

    /usr/sbin/makedumpfile -R */tmp/vmcore-rearranged* < *vmcore.flat*

For more information on how to set up and configure kdump, see How do I configure  kexec/kdump on Red Hat Enterprise Linux 5?.

Comments

When transferring a kdump core file via the SSH capture method, the core file is serialized for the transfer. This creates a vmcore.flat file in the receiving server's /var/crash directory. This file format cannot be read by Crash without first processing it with makedumpfile.


+ Recent posts