When a kernel encounters certain errors it calls the
"panic" function which results from a unrecoverable
error. This panic results in LKCD initiating a kernel dump where
kernel memory is copied out to the pre-designated dump area. The
dump device is configured as primary swap by default. The kernel
is not completely functional at this point, but there is enough
functionality to copy memory to disk. After dump finishes
copying memory to disk, the system re-boots. When the system
boots back up, it checks for a new crash dump. If a new crash
dump is found it is copied from the dump location to the file
system, "/var/log/dump" directory
by default. After copying the image, the system continues to boot
normally and forensics can be performed at a later date. lkcd-kernelxxx.diff file for patching the
kernel. The kernel version supported will change routinely.
lkcdutils-xx.src.rpm - this is the utilities
source and scripts you will need to setup and read a crash. At the
time of this writing there is a i386 binary rpm available from
lkcd.sourceforge.net,
but you will still need the patches for the startup scripts from the
source rpm. | |
| |
Free eBook: 
