CrashdumpRecipe

Differences between revisions 10 and 13 (spanning 3 versions)
Revision 10 as of 2013-03-20 22:02:42
Size: 10471
Editor: arges
Comment:
Revision 13 as of 2014-11-06 04:27:34
Size: 6840
Editor: penalvch
Comment: 1) RM'ed EoL releases. 2) RM'ed Lucid entry as bug reports are all fixed. 3) RM'ed 12.04 fixed bug entry.
Deletions are marked like this. Additions are marked like this.
Line 3: Line 3:
= Linux Kernel Crash Dump (LKCD) = = Ubuntu Kernel Crash Dump =
Line 5: Line 5:
[[http://lkcd.sourceforge.net/|LKCD]] is a project that tries to enable enterprise style post-mortem crash analysis in Linux operating systems. It uses a special mode of kexec which allows to automatically boot a secondary kernel whenever a crash (Oops/panic) occurs. This secondary kernel will then save the state and memory of the primary kernel to a certain location of the filesystem (''/var/crash'' on newer releases).
This file can then be used by '''crash''' to gather detailed information about the problem.
The Ubuntu Kernel Crash Dump is a mechanism that enable enterprise style post-mortem crash analysis in Linux operating systems. It uses a special mode of kexec which allows to automatically boot a secondary kernel whenever a crash (Oops/panic) occurs. This secondary kernel will then save the state and memory of the primary kernel to a certain location of the filesystem (''/var/crash'' on newer releases). This file can then be used by '''crash''' to gather detailed information about the problem.
Line 8: Line 7:
For convenience, the kernel crash dump utility has been packaged in Ubuntu. It can be installed with the following command:

{{{
 #> sudo apt-get install linux-crashdump
}}}
For convenience, the kernel crash dump utility has been packaged in Ubuntu. It can be installed with the following command: {{{
sudo apt-get install linux-crashdump }}}
Line 16: Line 12:
On boot this should automatically load the kernel used to boot as the secondary kernel used for crash dumps. Whether a kernel is loaded or not can be verified by checking the value of: On boot this should automatically load the kernel used to boot as the secondary kernel used for crash dumps. Whether a kernel is loaded or not can be verified by checking the value of: {{{
cat /sys/kernel/kexec_crash_loaded }}}

If the returned value is ''1'' the crash kernel has been loaded, if it is ''0'', then something went wrong. The crash kernel can also be loaded by running: {{{
sudo /etc/init.d/kdump start }}}

Starting with 13.04 Raring, the same behavior can be achieved by using the new kdump-tools mechanism after modifying /etc/default/kdump-tools by running (see [[#Release specific notes|Release specific notes]]) :
Line 19: Line 21:
 #> cat /sys/kernel/kexec_crash_loaded
 }}}

If the returned value is ''1'' the crash kernel has been loaded, if it is ''0'', then something went wrong. The crash kernel can also be loaded by running:

 {{{
 #> sudo /etc/init.d/kdump start
 #> sudo kdump-config load
Line 30: Line 26:
In order to test a crash, the simplest way is to use the sysrq mechanism. Causing a crash is done by either pressing ''<sysrq>+c'' or

{{{
 #> echo c | sudo tee /proc/sysrq-trigger
}}}
In order to test a crash, the simplest way is to use the sysrq mechanism. Causing a crash is done by either pressing ''<sysrq>+c'' or: {{{
echo c | sudo tee /proc/sysrq-trigger }}}
Line 38: Line 31:
If everything works, there should be some delay (depending on the memory size). Then the system reboots again into the normal mode. Usually ''apport'' kicks in and asks about reporting the issue. Alternatively the report file can be found under ''/var/crash'' and either placed somewhere else or be unpacked again by calling:

{{{
 #> apport-unpack <report file> <target directory>
}}}
If everything works, there should be some delay (depending on the memory size). Then the system reboots again into the normal mode. Usually ''apport'' kicks in and asks about reporting the issue. Alternatively the report file can be found under ''/var/crash'' and either placed somewhere else or be unpacked again by calling: {{{
apport-unpack <report file> <target directory> }}}
Line 54: Line 44:
deb http://ddebs.ubuntu.com/ precise main restricted universe multiverse
deb http://ddebs.ubuntu.com/ precise-security main restricted universe multiverse
deb http://ddebs.ubuntu.com/ precise-updates main restricted universe multiverse
deb http://ddebs.ubuntu.com/ precise-proposed main restricted universe multiverse
deb http://ddebs.ubuntu.com/ $(lsb_release -cs) main restricted universe multiverse
deb http://ddebs.ubuntu.com/ $(lsb_release -cs)-security main restricted universe multiverse
deb http://ddebs.ubuntu.com/ $(lsb_release -cs)-updates main restricted universe multiverse
deb http://ddebs.ubuntu.com/ $(lsb_release -cs)-proposed main restricted universe multiverse
Line 67: Line 57:
When installed, the debug kernel can be found under ''/usr/lib/debug/boot/'' and '''crash''' is started by:

{{{
 #> crash <debug kernel> <crash dump>
}}}
When installed, the debug kernel can be found under ''/usr/lib/debug/boot/'' and '''crash''' is started by: {{{
crash <debug kernel> <crash dump> }}}
Line 77: Line 64:
To get a local retrace, you need apport-retrace and then run:

{{{
 #> apport-retrace --stdout --rebuild-package-info /var/crash/linux-image*.crash
}}}
To get a local retrace, you need apport-retrace and then run: {{{
apport-retrace --stdout --rebuild-package-info /var/crash/linux-image*.crash }}}
Line 84: Line 68:
Line 93: Line 76:
 1. Reduce the size of the initrd. By default this is set to include all the modules and firmware ever needed. This allows using the same initrd on any system but increases its size a lot. In order to limit it to the modules really required to boot on the current hardware, change the following in ''/etc/initramfs-tools/initramfs.conf'':<<BR>>
{{{
 1. Reduce the size of the initrd. By default this is set to include all the modules and firmware ever needed. This allows using the same initrd on any system but increases its size a lot. In order to limit it to the modules really required to boot on the current hardware, change the following in ''/etc/initramfs-tools/initramfs.conf'': {{{
Line 97: Line 79:
 ...
}}}
 ... }}}
Line 102: Line 83:
This can be frustrating to debug, especially if you're unable to record the console messages from the new kexec kernel. A serial console attached to the system is best here to continue debugging. An easy troubleshooting step is to systematically eliminate the additional kernel parameters passed to the crash kernel and retrying. These arguments are kept in '''/etc/init.d/kdump''',

{{{
This can be frustrating to debug, especially if you're unable to record the console messages from the new kexec kernel. A serial console attached to the system is best here to continue debugging. An easy troubleshooting step is to systematically eliminate the additional kernel parameters passed to the crash kernel and retrying. These arguments are kept in '''/etc/init.d/kdump''': {{{
Line 115: Line 94:
...
}}}
... }}}
Line 119: Line 97:
install the new kexec crash kernel configuration.

{{{ sudo service kdump start }}}
install the new kexec crash kernel configuration: {{{
sudo service kdump start }}}
Line 127: Line 104:
== Ubuntu 13.04 "Raring Ringtail" ==

 * linux-crashdump now installs and uses kdump-tools by default
 * kdump-tools / makedumpfile have been modified to generate a .dmesg file along with the normal .dump files in a timestamped directory under /var/crash
 * apport has been modified to use the .dmesg file
 * apport generates a .crash report with a timestamp
 * Example of output in /var/crash:
   * linux-image-3.8.0-6-generic-201303201337.crash
     * crash report generated by apport
   * /var/crash/201303201337
     * content of latest crash
   * /var/crash/201303201337/dump.201303201337
     * will not be bundled into the apport report, contains vmcore file for use with crash and other utilities
   * /var/crash/201303201337/dmesg.201303201337
        content on kernel ring buffer before crash with backtrace

== Ubuntu 12.10 "Quantal Quetzal" ==

 * --([[https://bugs.launchpad.net/ubuntu/+source/kexec-tools/+bug/988512|Bug #988512: Missing /boot/vmcoreinfo-{version} file is breaking kdump]])--<<BR>>
 Because of some kernel code changes, the vmcoreinfo file cannot be generated. However, the required information can now be obtained from the kernel on doing the dump. But the scripts to load the crash kernel and to create the dump still depend on it (see the no-vmcoreinfo patch in the bug report).
 * [[https://bugs.launchpad.net/ubuntu/+source/kexec-tools/+bug/785394|Bug 785394: Hard-coded crashkernel=... memory reservation in /etc/grub.d/10_linux is insufficient]]<<BR>>
 The default allocation for systems below 2G is not enough for the current initrd size. Manually adapting the size allows to use the crash kernel.
 * The current (1.4.3-1) version of makedumpfile reports to be incompatible with the 3.2 kernel. The dumps created seem to be ok.
Line 153: Line 106:
 * --([[https://bugs.launchpad.net/ubuntu/+source/kexec-tools/+bug/988512|Bug #988512: Missing /boot/vmcoreinfo-{version} file is breaking kdump]])--<<BR>>
 Because of some kernel code changes, the vmcoreinfo file cannot be generated. However, the required information can now be obtained from the kernel on doing the dump. But the scripts to load the crash kernel and to create the dump still depend on it (see the no-vmcoreinfo patch in the bug report).
Line 158: Line 109:


== Ubuntu 10.04 "Lucid Lynx" ==

 * --([[https://bugs.launchpad.net/ubuntu/+source/apport/+bug/533565|Bug #533565 in apport (Ubuntu): "Strings missing from the apport template"]])--<<BR>>
 ''This bug was fixed in the package python-distutils-extra - 2.19'' (in lucid it's 2.18bzr1)
 * [[https://bugs.launchpad.net/ubuntu/+source/apport/+bug/592239|Bug #592239 in apport (Ubuntu): "apport-retrace - IndexError: list index out of range"]]

== Ubuntu 9.04 "Jaunty Jackalope" ==

This page describes a recipe for enabling crash dump vmcore analysis on your Jaunty x86/x86_64 platform. Much of the information was gleaned from the kernel source tree files in Documentation/kdump.

  * 'apt-get install linux-crashdump'
    This is a meta package that installs all of the tools necessary to acquire and analyse a crash-dump vmcore.

  * Add 'crashkernel=64M@16M' to the kernel command line in /boot/grub/menu.lst.
    You'll also probably want to remove 'quiet splash'.

  * Reboot the system (into the ordinary kernel). The section of RAM above will now be reserved for the crashkernel (and not available to the normal system).

  * Make note of your root partition, e.g., /dev/sda1
    '''kexec -p /boot/vmlinuz-{{{`uname -r`}}} --initrd=/boot/initrd.img-{{{`uname -r`}}} --append="root=<ROOT_PARTITION> irqpoll maxcpus=1"'''
    This loads the crash-dump kernel into the reserved memory, in preparation for a panic.

  Now your kernel is ready to acquire a post-crash vmcore.

Ubuntu Kernel Crash Dump

The Ubuntu Kernel Crash Dump is a mechanism that enable enterprise style post-mortem crash analysis in Linux operating systems. It uses a special mode of kexec which allows to automatically boot a secondary kernel whenever a crash (Oops/panic) occurs. This secondary kernel will then save the state and memory of the primary kernel to a certain location of the filesystem (/var/crash on newer releases). This file can then be used by crash to gather detailed information about the problem.

For convenience, the kernel crash dump utility has been packaged in Ubuntu. It can be installed with the following command:

sudo apt-get install linux-crashdump 

Newer versions of the package will automatically add an entry crashkernel=384M-2G:64M,2G-:128M to the kernel commandline in grub. However this may cause problems on systems with less than 2G of memory (see troubleshooting).

On boot this should automatically load the kernel used to boot as the secondary kernel used for crash dumps. Whether a kernel is loaded or not can be verified by checking the value of:

cat /sys/kernel/kexec_crash_loaded 

If the returned value is 1 the crash kernel has been loaded, if it is 0, then something went wrong. The crash kernel can also be loaded by running:

sudo /etc/init.d/kdump start 

Starting with 13.04 Raring, the same behavior can be achieved by using the new kdump-tools mechanism after modifying /etc/default/kdump-tools by running (see Release specific notes) :

  •  #> sudo kdump-config load

Causing a test crash

In order to test a crash, the simplest way is to use the sysrq mechanism. Causing a crash is done by either pressing <sysrq>+c or:

echo c | sudo tee /proc/sysrq-trigger 

Warning /!\ Note that this might be disabled in some releases. /proc/sys/kernel/sysrq needs to be set to 1 in order to let all of the sysrq keys work.

If everything works, there should be some delay (depending on the memory size). Then the system reboots again into the normal mode. Usually apport kicks in and asks about reporting the issue. Alternatively the report file can be found under /var/crash and either placed somewhere else or be unpacked again by calling:

apport-unpack <report file> <target directory> 

Inspecting the crash dump

Using crash

In order to use the generated crash dump with crash one needs the vmlinux file which has the debugging information. This is part of the kernel ddeb package which can be found at:

http://ddebs.ubuntu.com/pool/main/l/linux/

sudo tee /etc/apt/sources.list.d/ddebs.list << EOF
deb http://ddebs.ubuntu.com/ $(lsb_release -cs)          main restricted universe multiverse
deb http://ddebs.ubuntu.com/ $(lsb_release -cs)-security main restricted universe multiverse
deb http://ddebs.ubuntu.com/ $(lsb_release -cs)-updates  main restricted universe multiverse
deb http://ddebs.ubuntu.com/ $(lsb_release -cs)-proposed main restricted universe multiverse
EOF

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ECDCAD72428D7C01
sudo apt-get update
sudo apt-get install linux-image-$(uname -r)-dbgsym

Warning /!\ Be aware that those packages are huge! (~600 MB)

When installed, the debug kernel can be found under /usr/lib/debug/boot/ and crash is started by:

crash <debug kernel> <crash dump> 

Unfortunately the tool does not allow to look at a 32bit dump on a 64bit system and the other way round. Also it tends to be quite picky about matching up kernel and dump.

Using apport-retrace

To get a local retrace, you need apport-retrace and then run:

apport-retrace --stdout --rebuild-package-info /var/crash/linux-image*.crash 

Warning /!\ Again, this can take a while because it needs to download the kernel debug package.

Troubleshooting

Allocated memory for the crash kernel

When testing crash dump sometimes the system just seems to lock up. The main issue there is how much memory was assigned for the crash kernel. When kexec starts the crash kernel it requires enough memory to fit the unpacked kernel, the compressed initrd and the uncompressed initrd (at least while unpacking). If there is not enough memory allocated, things usually go wrong without any hint. To solve this there are the following options:

  1. Increase the allocation by changing crashkernel= on the grub command line or in /boot/grub/grub.cfg (for grub2) or /boot/grub/menu.lst (for old grub). To avoid loosing the settings when running update-grub the change can be made in /etc/grub.d/10_linux.

  2. Reduce the size of the initrd. By default this is set to include all the modules and firmware ever needed. This allows using the same initrd on any system but increases its size a lot. In order to limit it to the modules really required to boot on the current hardware, change the following in /etc/initramfs-tools/initramfs.conf:

     ...
     MODULES=dep
     ... 

Crash kernel fails to load: Hang

This can be frustrating to debug, especially if you're unable to record the console messages from the new kexec kernel. A serial console attached to the system is best here to continue debugging. An easy troubleshooting step is to systematically eliminate the additional kernel parameters passed to the crash kernel and retrying. These arguments are kept in /etc/init.d/kdump:

...
        # Append kdump_needed for initramfs to know what to do, and add
        # maxcpus=1 to keep things sane.
        APPEND="$APPEND kdump_needed maxcpus=1 irqpoll reset_devices"

        # --elf32-core-headers is needed for 32-bit systems (ok
        # for 64-bit ones too).
        log_action_begin_msg "Loading crashkernel"
        kexec -p "$KERNEL_IMAGE" --initrd="$INITRD" --append="$APPEND"
        log_action_end_msg $?
... 

Leave $APPEND and kdump_needed. Start by removing reset_devices and then install the new kexec crash kernel configuration:

sudo service kdump start 

Then retest; if that doesn't work, remove the next argument, rinse and repeat.

Release specific notes

Ubuntu 12.04 "Precise Pangolin"

Kernel/CrashdumpRecipe (last edited 2016-07-17 10:44:24 by shalzz95)