All Products: How to configure Kdump for Linux kernel crash dump
search cancel

All Products: How to configure Kdump for Linux kernel crash dump


Article ID: 286946


Updated On:


Carbon Black App Control (formerly Cb Protection) Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter) Carbon Black EDR (formerly Cb Response)


To enable and configure Kdump for Linux kernel crash dump collection


  • All Products
  • Red Hat: All supported versions
  • CentOS: All supported versions


The Kdump service is installed and enabled by default on newer RHEL 7+ systems
  1. Check if kexec is installed and kdump is active
    rpm -q kexec-tools
    systemctl status kdump.service
  2. Enabling Kdump 
    • Install the kexec tools
      yum install kexec-tools
    • Reserve memory for kdump in the grub config file (/etc/default/grub) by appending "crashkernel=auto" to the following line:
    • Update the grub configuration file:
      grub2-mkconfig -o /boot/grub2/grub.cfg
  3. Enable and start the kdump service:
    systemctl enable kdump.service
    systemctl start kdump.service
  4. Once a system crash occurs, please zip any vmcore dump files from their default location:
    tar cvfz /tmp/crash-logs.tgz /var/crash
  • If the vmcore files are missing, please check if the path for writing crash logs has been modified in the config file: /etc/kdump.conf

Additional Information

The steps enable Kdump with default options; to customize Kdump please check the following Red Hat KB