kdump
also: kernel crash dump, crash dumping
A Linux kernel crash dumping mechanism that captures the state of a crashed kernel to a file for later analysis and debugging.
kdump is a kernel crash dumping feature that allows the Linux kernel to capture a memory image when it crashes or encounters an unrecoverable error. It works by reserving a portion of system memory for a small "capture kernel" that runs after the main kernel fails, enabling safe collection of crash data without further data corruption.
When a crash occurs, kdump boots into this reserved kernel environment and writes the memory contents of the failed kernel to a file (usually in /var/crash/). System administrators can then analyze this dump file using tools like crash or gdb to determine the root cause of kernel panics.
Example: A system crashes with a kernel panic. kdump automatically boots a minimal kernel, captures the failed kernel's memory state to /var/crash/dump.20240115-143022, then either reboots or halts. The dump file can later be analyzed to identify driver bugs, memory corruption, or other kernel issues.