makedumpfile (8) - Linux Man Pages
makedumpfile: make a small dumpfile of kdump
NAMEmakedumpfile - make a small dumpfile of kdump
SYNOPSISmakedumpfile [OPTION] [-x VMLINUX|-i VMCOREINFO] VMCORE DUMPFILE
makedumpfile -F [OPTION] [-x VMLINUX|-i VMCOREINFO] VMCORE
makedumpfile [OPTION] -x VMLINUX [--config FILTERCONFIGFILE] [--eppic EPPICMACRO] VMCORE DUMPFILE
makedumpfile -R DUMPFILE
makedumpfile --split [OPTION] [-x VMLINUX|-i VMCOREINFO] VMCORE DUMPFILE1 DUMPFILE2 [DUMPFILE3 ..]
makedumpfile [OPTION] [-x VMLINUX|-i VMCOREINFO] --num-threads THREADNUM VMCORE DUMPFILE
makedumpfile --reassemble DUMPFILE1 DUMPFILE2 [DUMPFILE3 ..] DUMPFILE
makedumpfile -g VMCOREINFO -x VMLINUX
makedumpfile [OPTION] [--xen-syms XEN-SYMS|--xen-vmcoreinfo VMCOREINFO] VMCORE DUMPFILE
makedumpfile --dump-dmesg [-x VMLINUX|-i VMCOREINFO] VMCORE LOGFILE
makedumpfile [OPTION] -x VMLINUX --diskset=VMCORE1 --diskset=VMCORE2 [--diskset=VMCORE3 ..] DUMPFILE
With kdump, the memory image of the first kernel (called "panicked kernel") can be taken as /proc/vmcore while the second kernel (called "kdump kernel" or "capture kernel") is running. This document represents /proc/vmcore as VMCORE. makedumpfile makes a small DUMPFILE by compressing dump data or by excluding unnecessary pages for analysis, or both. makedumpfile needs the first kernel's debug information, so that it can distinguish unnecessary pages by analyzing how the first kernel uses the memory. The information can be taken from VMLINUX or VMCOREINFO.
makedumpfile can exclude the following types of pages while copying
VMCORE to DUMPFILE, and a user can choose which type of pages will
- Pages filled with zero
- Cache pages without private flag (non-private cache)
- Cache pages with private flag (private cache)
- User process data pages
- Free pages
makedumpfile provides two DUMPFILE formats (the ELF format and the kdump-compressed format). By default, makedumpfile makes a DUMPFILE in the kdump-compressed format. The kdump-compressed format is readable only with the crash utility, and it can be smaller than the ELF format because of the compression support. The ELF format is readable with GDB and the crash utility. If a user wants to use GDB, DUMPFILE format has to be explicitly specified to be the ELF format.
Apart from the exclusion of unnecessary pages mentioned above, makedumpfile allows user to filter out targeted kernel data. The filter config file can be used to specify kernel/module symbols and its members that need to be filtered out through the erase command syntax. makedumpfile reads the filter config and builds the list of memory addresses and its sizes after processing filter commands. The memory locations that require to be filtered out are then poisoned with character 'X' (58 in Hex). Refer to makedumpfile.conf(5) for file format.
Eppic macros can also be used to specify kernel symbols and its members that need to be filtered. Eppic provides C semantics including language constructs such as conditional statements, logical and arithmetic operators, functions, nested loops to traverse and erase kernel data. --eppic requires eppic_makedumpfile.so and eppic library. eppic_makedumpfile.so can be built from makedumpfile source. Refer to http://code.google.com/p/eppic/ to build eppic library libeppic.a and for more information on writing eppic macros.
To analyze the first kernel's memory usage, makedumpfile can refer to
VMCOREINFO instead of VMLINUX. VMCOREINFO contains the first
kernel's information (structure size, field offset, etc.), and VMCOREINFO
is small enough to be included into the second kernel's initrd.
If the second kernel is running on its initrd without mounting a root file system, makedumpfile cannot refer to VMLINUX because the second kernel's initrd cannot include a large file like VMLINUX. To solve the problem, makedumpfile makes VMCOREINFO beforehand, and it refers to VMCOREINFO instead of VMLINUX while the second kernel is running.
VMCORE has contained VMCOREINFO since linux-2.6.24, and a user does not need to specify neither -x nor -i option.
If the second kernel is running on its initrd without mounting any file system, a user needs to transport the dump data to a remote host. To transport the dump data by SSH, makedumpfile outputs the dump data in the intermediate format (the flattened format) to the standard output. By piping the output data to SSH, a user can transport the dump data to a remote host. Note that analysis tools (crash utility before version 5.1.2 or GDB) cannot read the flattened format directly, so on a remote host the received data in the flattened format needs to be rearranged to a readable DUMPFILE format by makedumpfile (or makedumpfile-R.pl).
makedumpfile can read a DUMPFILE in the kdump-compressed format instead
of VMCORE and re-filter it. This feature is useful in situation that
users need to reduce the file size of DUMPFILE for sending it somewhere
by ftp/scp/etc. (If all of the page types, which are specified by a new dump_level,
are excluded from an original DUMPFILE already, a new DUMPFILE is the
same as an original DUMPFILE.)
For example, makedumpfile can create a DUMPFILE of dump_level 31 from the one of dump_level 3 like the following:
# makedumpfile -c -d 3 /proc/vmcore dumpfile.1
# makedumpfile -c -d 31 dumpfile.1 dumpfile.2
makedumpfile can read VMCORE(s) in three kinds of sadump formats: single partition format, diskset format and media backup format, and can convert each of them into kdump-compressed format with filtering and compression processing. Note that for VMCORE(s) created by sadump, you always need to pass VMLINUX with -x option. Also, to pass multiple VMCOREs created on diskset configuration, you need to use --diskset option.
Compress dump data by each page using zlib for -c option, lzo for -l
option or snappy for -p option.
(-l option needs USELZO=on and -p option needs USESNAPPY=on when building)
A user cannot specify this option with -E option, because the ELF format does not support compressed data.
# makedumpfile -c -d 31 -x vmlinux /proc/vmcore dumpfile
Specify the type of unnecessary page for analysis.
Pages of the specified type are not copied to DUMPFILE. The page type marked in the following table is excluded. A user can specify multiple page types by setting the sum of each page type for dump_level. The maximum of dump_level is 31. Note that a dump_level for Xen dump filtering is 0 or 1 on a machine other than x86_64. On a x86_64 machine, even 2 or bigger dump level will be effective if you specify domain-0's vmlinux with -x option. Then the pages are excluded only from domain-0.
If specifying multiple dump_levels with the delimiter ',', makedumpfile retries to create a DUMPFILE by other dump_level when "No space on device" error happens. For example, if dump_level is "11,31" and makedumpfile fails by dump_level 11, makedumpfile retries it by dump_level 31.
# makedumpfile -d 11 -x vmlinux /proc/vmcore dumpfile
# makedumpfile -d 11,31 -x vmlinux /proc/vmcore dumpfile
dump_level consists of five bits, so there are five base levels to specify the type of unnecessary page.
Here is the all combinations of the bits.
| |non- | | |
dump | zero |private|private| user | free
level | page |cache |cache | data | page
0 | | | | |
1 | X | | | |
2 | | X | | |
3 | X | X | | |
4 | | X | X | |
5 | X | X | X | |
6 | | X | X | |
7 | X | X | X | |
8 | |