Understanding kexec and kdump on Linux

Updated: 28 September 2026 · Applies to: kexec-tools 2.0.29 to 2.0.32 on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10; kdump-tools on Ubuntu 24.04 and 26.04 and Debian 13

When the Linux kernel crashes (a "kernel panic"), the server usually reboots or freezes and the cause is lost. kdump saves it: a small second kernel is kept ready in reserved memory, and when the main kernel crashes, kexec starts that second kernel at once, without going through the firmware. It then writes the memory of the crashed kernel (a "vmcore") to disk, where you or a support engineer can analyse it.

How it fits together

• crashkernel= on the kernel command line reserves memory for the capture kernel at boot.
• The kdump service loads the capture kernel into that memory.
• On a crash, the capture kernel saves the vmcore, by default to /var/crash/, and reboots.

AlmaLinux, Rocky Linux and RHEL 9 and 10

1. Install and enable it (often already done by the installer):

   dnf install kexec-tools
   systemctl enable --now kdump

2. Check the memory reservation. On an AlmaLinux 9 server we checked, the command line contains crashkernel=1G-2G:192M,2G-64G:256M,64G-:512M: the reserved amount depends on the installed RAM. To set the recommended default:

   kdumpctl reset-crashkernel --kernel=ALL
   reboot

3. Check that it is ready:

   kdumpctl status          # "Kdump is operational"
   kdumpctl showmem         # how much memory is reserved

The settings are in /etc/kdump.conf: path (where vmcores go), core_collector makedumpfile -l --message-level 7 -d 31 (compressed, leaving out unneeded pages), and options to save to another disk or over NFS or SSH. Run kdumpctl restart after changes.

Ubuntu and Debian

apt install kdump-tools         # Ubuntu may offer the meta package linux-crashdump
kdump-config show

The installer asks whether to enable kdump and adds the crashkernel setting; reboot afterwards. Dumps are saved in /var/crash/.

Test it (planned downtime only)

The only real test is a deliberate kernel crash, which reboots the server at once. Only do this on a test machine or in a maintenance window:

kdumpctl test                     # AlmaLinux, Rocky Linux, RHEL: asks "proceed? (y/N)", then crashes the kernel
echo c > /proc/sysrq-trigger     # any distribution: crash immediately

After the reboot, a new folder in /var/crash/ should contain a vmcore and a vmcore-dmesg.txt.

After a crash

Read vmcore-dmesg.txt first: the last lines usually show the panic message and the function that failed. For deeper analysis, the crash utility with the matching kernel debug symbols opens the vmcore. Support teams often ask for the vmcore itself; it can be large, so keep enough free space in /var/crash.

Official documentation: Configuring kdump on the command line (Red Hat) and kdump documentation (Linux kernel).