All Products: How to configure Kdump for Linux kernel crash dump

Products

• Carbon Black App Control (formerly Cb Protection)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To enable and configure Kdump for Linux kernel crash dump collection

Environment

• All Products
• Red Hat: All supported versions
• CentOS: All supported versions

Resolution

The Kdump service is installed and enabled by default on newer RHEL 7+ systems

 

1. Check if kexec is installed and kdump is active

   rpm -q kexec-tools
   systemctl status kdump.service

2. Enabling Kdump 
   • Install the kexec tools

     yum install kexec-tools

   • Reserve memory for kdump in the grub config file (/etc/default/grub) by appending "crashkernel=auto" to the following line:

     GRUB_CMDLINE_LINUX="...crashkernel=auto..."

   • Update the grub configuration file:

     grub2-mkconfig -o /boot/grub2/grub.cfg

3. Enable and start the kdump service:

   systemctl enable kdump.service
   systemctl start kdump.service

4. Once a system crash occurs, please zip any vmcore dump files from their default location:

   tar cvfz /tmp/crash-logs.tgz /var/crash

• If the vmcore files are missing, please check if the path for writing crash logs has been modified in the config file: /etc/kdump.conf

Additional Information

The steps enable Kdump with default options; to customize Kdump please check the following Red Hat KB