<HTML
><HEAD
><TITLE
>How LKCD Works</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.63
"><LINK
REL="HOME"
TITLE="Linux Crash HOWTO"
HREF="index.html"><LINK
REL="PREVIOUS"
TITLE="Introduction"
HREF="intro.html"><LINK
REL="NEXT"
TITLE="Installation of lkcd"
HREF="install.html"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>Linux Crash HOWTO</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="intro.html"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="install.html"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="HOWITWORKS"
>2. How LKCD Works</A
></H1
><P
> When a kernel encounters certain errors it calls the
"panic" function which results from a unrecoverable
error. This panic results in LKCD initiating a kernel dump where
kernel memory is copied out to the pre-designated dump area. The
dump device is configured as primary swap by default. The kernel
is not completely functional at this point, but there is enough
functionality to copy memory to disk. After dump finishes
copying memory to disk, the system re-boots. When the system
boots back up, it checks for a new crash dump. If a new crash
dump is found it is copied from the dump location to the file
system, "<TT
CLASS="FILENAME"
>/var/log/dump</TT
>" directory
by default. After copying the image, the system continues to boot
normally and forensics can be performed at a later date. </P
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="WHATYOUNEED"
>2.1. What You Need</A
></H2
><P
> <TT
CLASS="FILENAME"
>lkcd-kernelxxx.diff</TT
> file for patching the
kernel. The kernel version supported will change routinely.
<TT
CLASS="FILENAME"
>lkcdutils-xx.src.rpm</TT
> - this is the utilities
source and scripts you will need to setup and read a crash. At the
time of this writing there is a i386 binary rpm available from
<A
HREF="http://lkcd.sourceforge.net/"
TARGET="_top"
>lkcd.sourceforge.net</A
>,
but you will still need the patches for the startup scripts from the
source rpm. </P
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="intro.html"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="install.html"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Introduction</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
> </TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Installation of lkcd</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>
