The configuration file for Kdump is /etc/kdump.conf. The default target location for the vmcore is the /var/crash directory on the local file system, which is represented as follows:
path /var/crash
To write to a different local directory, edit the path directive and provide the absolute path. Example:
path /
To write directly to a device, edit the raw directive and specify the device name. Example:
raw /dev/sda1
To write to a remote system by using NFS, use the nfs directive followed by the FQDN of the remote system, then a colon (:), and then the directory path. Example:
nfs host01.example.com:/export/crash
To write to a remote machine by using SSH, use the ssh directive followed by a valid username, the @ sign, and the host name, in that order. Example:
ssh root@host02.example.com
Modify the filtering level for the vmcore dump using the core_collector directive in the /etc/kdump.conf file. To exclude certain pages from the dump, use the -d [value] parameter where [value] is a sum of values of the pages that you want to exclude. Use the following values for the pages:
- 1: zero page
- 2: cache page
- 4: cache private
- 8: user data
- 16: free page
The recommendation is to exclude all these pages as follows. Add the values (the total for all is 31) and provide the sum as the argument to the -d (dump level) option:
core_collector makedumpfile -d 31 –c
The -c option enables dump file compression. To exclude only zero (1) and free (16) pages:
core_collector makedumpfile -d 17 –c
The default action to take if dumping to the intended target fails is to reboot. Other possible actions are halt, poweroff, shell, or dump_to_rootfs, which means dump vmcore to rootfs from initramfs context and reboot. To change this, set the default directive in /etc/kdump.conf, as in this example:
default poweroff