kdump (Linux)

When triggered, kdump exports a memory image (also known as vmcore) that can be analyzed for the purposes of debugging and determining the cause of a crash.

As a result, the system boots into a clean and reliable environment instead of relying on an already crashed kernel that may cause various issues, such as causing file system corruption while writing a memory dump file.

This reserved amount of RAM is used solely by the dump-capture kernel and is otherwise unused during normal system operation.

Some architectures, including x86 and ppc64, require a small fixed-position portion of RAM to boot a kernel regardless of where it is loaded; in this case, kexec creates a copy of that portion of RAM so it is also accessible to the dump-capture kernel.

[6][7][8] Created memory dump files can be analyzed using the GNU Debugger (gdb), or by using Red Hat's dedicated crash utility.

In a "dual kernel" layout, kdump uses kexec to boot another kernel and obtain a memory dump. [ 3 ] : 10