Speeding up kernel crash hang analysis with the kernel log

This is a summaries article taken from RHEL6: Speeding up kernel crash / hang analysis with the kernel log.

When there is a kernel crash or hang, there is often a very large file is produced containing a memory dump of the entire system called a vmcore. Analysis of the kernel crash or hang often requires this large file be uploaded to Red Hat for analysis (if you have subscription)


For RHEL 6.4 and above

Starting with RHEL 6.4, Starting with Red Hat Enterprise Linux 6.4 and kexec-tools-2.0.0-258.el6, the kdump process will dump the kernel log to a file called vmcore-dmesg.txt before creating the vmcore file.

# ls /var/crash/\:49\:25/
vmcore  vmcore-dmesg.txt
# cp /var/crash/\:49\:25/vmcore-dmesg.txt /tmp/00123456-vmcore-dmesg.txt

For RHEL 6.0 to RHEL 6.3, 

For other versions of Red Hat Enterprise Linux 6, or for cases where vmcore-dmesg.txt is not generated, you can use the following makedumpfile command to obtain the kernel log from an existing vmcore. NOTE: The makedumpfile command is part of the kexec-tools package)

# makedumpfile --dump-dmesg [path-to-vmcore] [kernel-log-file]
# makedumpfile --dump-dmesg /var/crash/\:26\:07/vmcore /tmp/00123456-vmcore-dmesg.txt
The dmesg log is saved to /tmp/00123456-vmcore-dmesg.txt.
makedumpfile Completed.

NOTE: If the above command fails, it may indicate the vmcore is corrupt to the point of not containing any useful information.