当前位置：首页 > 行业动态 > 正文

linux kdump分析

admin
行业动态
2023-12-30
2

kdump是一种先进的基于kexec的内核崩溃转储机制，用来在系统崩溃时将内存中的数据转储到磁盘上，以便于后续的分析和调试。

如何使用Kdump检查Linux内核崩溃

Kdump是Linux系统中用于处理内核崩溃的一种工具，它可以帮助我们诊断和解决内核崩溃问题，本文将详细介绍如何使用Kdump检查Linux内核崩溃，并提供一些相关问题的解答。

了解Kdump

Kdump(Kernel Dump)是Linux内核自带的一个用于生成内核转储文件的工具，当系统发生内核崩溃时，Kdump会捕获当前系统的内存镜像(通常保存在/proc/pid/mem),然后将这些信息写入到一个名为core.gz的压缩文件中，这个文件包含了内核崩溃时的所有上下文信息，可以帮助我们分析问题原因。

配置Kdump

要使用Kdump检查内核崩溃，首先需要确保Kdump已经正确配置，以下是一些常见的Kdump配置选项：

1、设置自动生成核心转储文件：在/etc/sysctl.conf文件中添加或修改以下配置项：

kernel.core_pattern = /tmp/core-%e-%p-%t
fs.suid_dumpable = 2

kernel.core_pattern指定了核心转储文件的存储路径和文件名格式；fs.suid_dumpable设置为2表示允许所有用户生成核心转储文件。

2、设置Kdump的最大大小限制：在/etc/security/limits.conf文件中添加或修改以下配置项：

soft core unlimited
hard core unlimited

这将为所有用户分配无限大的内核堆栈大小，以便在发生内核崩溃时能够获取足够的信息。

3、设置Kdump的启动方式：可以使用systemd或init.d脚本来管理Kdump的启动，创建一个名为kdump.service的服务文件，内容如下：

[Unit]
Description=Kernel Dump Service
Requires=network-online.target
After=network-online.target
[Service]
Type=forking
ExecStartPre=/bin/sh -c '/usr/sbin/sysctl -w kernel.core_uses_pid=1' 2> /dev/null
ExecStart=/usr/sbin/kdump --no-block --exec-file=/path/to/your/script.sh %i > /tmp/kdump.log 2>&1 &
ExecStop=/bin/killall -HUP kdump && wait %i || echo "Failed to stop kdump" > /tmp/kdump.log 2>&1 &
Restart=on-failure
RestartSec=5s
LimitNOFILE=65536
TimeoutStopSec=0
SendSIGHUP=yes
User=%i
Group=%i
Environment=HOME="/root",PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" KRB5CCNAME=FILE:/tmp/krb5cc_%u@EXAMPLE.COM KEYTAB=FILE:/tmp/krb5keytab_%u EXAMPLE_REALM=EXAMPLE.COM KRB5RCACHEDIR=FILE:/tmp/krb5rcache_%u KRB5LOGDIR=FILE:/tmp/krb5log_%u KRB5CONFIGDIR=FILE:/etc/krb5.conf KRB5SKIPPORTCHECK=true GSSAPIAuthentication=true GSSAPIDelimiter='--' GSSAPILibraryPath=libgssapi_krb5 UNIX_STDIO_MODE=0 OAUTH2_CLIENT_ID=YOUR_CLIENT_ID OAUTH2_CLIENT_SECRET=YOUR_CLIENT_SECRET OAUTH2_TOKEN_URL=https://example.com/oauth2/token OAUTH2_REFRESH_URL=https://example.com/oauth2/refresh OAUTH2_SCOPE=openid profile email https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/gmail.readonly https://www.googleapis.com/auth/gmail.modify https://www.googleapis.com/auth/spreadsheets https://www.googleapis.com/auth/drive https://www.googleapis.com/auth/admin.reports README="This system is for use in the context of your organization only" AUTHOR="Your Name <your@email>" DESTINATION="/root" PIDFILE="/var/run/kdump-%h" SENDER="/usr/sbin/sendmail -oi -t" VERBOSE=0 DEADLOCKTIMEOUT=60 SECS DEADLOCKDEBUG=0 ENABLED_LIMITS="kernel memory" DISABLED_LIMITS="" MAXIMUM_TASKS="10000" STACKSIZE="8388608" THREADSAFE=false PREEMPTIBLE=false TIMEOUT="10" PRIORITY="19" ALLOCATING_CPUS="0" ALLOCATING_MEMORY="unlimited" ALLOCATING_FDS="unlimited" ALLOCATING_STREAMS="unlimited" ALLOCATING_POLLS="unlimited" ALLOCATING_RENDEZVOUS="unlimited" ALLOCATING_NETINET="unlimited" ALLOCATING_KEYRING="unlimited" ALLOCATING_CAPABILITY="unlimited" ALLOCATING_PRIORITIZED="unlimited" ALLOCATING_USERNS="unlimited" ALLOCATING_IPC="unlimited" ALLOCATING_MSGQUEUE="unlimited" ALLOCATING_SHM="unlimited" ALLOCATING_NSSDB="unlimited}'
ExecStopPost=-/bin/killall -HUP dumpcap || echo "Failed to kill dumpcap after stop" > /tmp/kdump.log 2>&1 &
RestartSec=5s StartLimitIntervalSec=0 StopWaitsec=300 RestartLimitIntervalSec=120 StartLimitBurst=3 RestartLimitAction=always KillMode=process TimeoutStopSec=120 KillSignal=SIGINT KRB5CCNAME=FILE:%u @EXAMPLE.COM KEYTAB=FILE:%u EXAMPLE_REALM=EXAMPLE.COM KRB5RCACHEDIR=%u KRB5LOGDIR=%u KRB5CONFIGDIR=%u GSSAPIAuthentication=true GSSAPIDelimiter='--' GSSAPILibraryPath=libgssapi_krb5 UNIX_STDIO_MODE=0 OAUTH2_CLIENT_ID=$OAUTH2_CLIENT_ID OAUTH2_CLIENT_SECRET=$OAUTH2_CLIENT_SECRET OAUTH2_TOKEN_URL=$OAUTH2_TOKEN_URL OAUTH2_REFRESH_URL=$OAUTH2_REFRESH OAUTH2_SCOPE=$OAUTH2_SCOPE README="This system is for use in the context of your organization only" AUTHOR="Your Name <your@email>" DESTINATION=%h PIDFILE="/var/run/kdump-%h" SENDER="/usr/sbin/sendmail -oi -t" VERBOSE=0 DEADLOCKTIMEOUT=60 SECS DEADLOCKDEBUG=0 ENABLED_LIMITS="kernel memory" DISABLED_LIMITS="" MAXIMUM_TASKS=$MAXIMUM_TASKS STACKSIZE=$STACKSIZE THREADSAFE=$THREADSAFE PREEMPTIBLE=$PREEMPTIBLE TIMEOUT=$TIMEOUT PRIORITY=$PRIORITY ALLOCATING_CPUS=$ALLOCATING_CPUS ALLOCATING_MEMORY=$ALLOCATING_MEMORY ALLOCATING_FDS=$ALLOCATING_FDS ALLOCATING_STREAMS=$ALLOCATING_STREAMS ALLOCATING_POLLS=$ALLOCATING_POLLS ALLOCATING_RENDEZVOUS=$ALLOCATING