StoneBlog.stonesoft.com

Starting from Firewall/VPN 4.2.3, engine kernel crashdumper can be enabled for all our appliances.

sg-bootconfig --crashdump=yes apply && reboot

What it does now:

1. The dmesg (kernel console output) is extracted from memory and stored as /data/diagnostics/kerneldump-dmesg-<timestamp>. This should work with any model. Note that this is dump from kernel ring buffer, so the messages can be out of order.
2. If the /data/config/base/spool-in-ram file exists, a mini kernel dump is created. That is, a special tool makedumpfile extracts only essential parts of memory to dump and compress it on the fly. The mini dump is created to /data/diagnostics/. The size of the dump varies, but it is typically 10-20% of total memory.
   The dump file is not automatically removed, so constantly crashing machine can fill up the /data partition.
3. If that file does not exists, the dump is created to /spool/dump/ as previously. The kernel crashdump file is compressed on the fly, so the disk space requirement is now decreased.

Filename of dump file is of form kerneldump-<timestamp>.

written by RoarinPenguin - 455 views \\ tags: console msgs to file, crashdumper, Firewall Engine