Skill 3 in course 3.1: Method and Evidence

Crash Dumps and Support Data

Capture a kernel crash with kdump, read the first clues, and collect a clean support archive with sos.

Advanced2 lessons6 exercises1 h 30 min
Start skill

You will be able to

  • Reserve memory for the capture kernel, configure where dumps go, and prove kdump is ready.
  • Trigger a controlled crash on a lab machine and find the vmcore and its first useful clue.
  • Create a support archive with sos report, limit or obfuscate its content, and know what is inside.

Lessons

  1. 01Capturing a kernel crash with kdumpReserve crash memory, configure the dump target, test with a controlled crash and read the first clues.kdumpctlkdumpctl estimatekdumpctl statuskdumpctl reset-crashkernel/etc/kdump.confgrubby0/3 exercises
  2. 02Collecting system information with sos reportCreate a support archive with sos report, choose plugins, protect sensitive data and read the archive yourself.sos reportsos report --list-pluginssos report -osos report -nsos cleansos report --batch0/3 exercises