Where Does Linux kdump Store Kernel Crash Dumps?
Linux kdump crash dumps in /var/crash, the kdump.conf settings file, and how to confirm the service actually runs.
Last updated
kdump captures the kernel when Linux panics, writing the vmcore dump into /var/crash by default. Settings live in /etc/kdump.conf: path, targets, what to filter. The service needs kexec tooling and reserved memory, so an empty crash folder usually means setup, not luck.
Do not confuse it with userspace core dumps. systemd-coredump handles crashed programs; kdump handles a dead kernel. Check both locations when a box dies mysteriously, since each covers the other's blind spot.
Where Linux stores this, by platform
/var/crash
Default dump target from kdump.conf; each panic gets its own timestamped directory with vmcore plus dmesg. Dumps are RAM sized, so watch disk usage. The config file alongside controls path, compression and what gets captured.
Frequently asked questions
kdump is installed but /var/crash stays empty, why?
Check that kexec tools and the kdump service are installed and enabled, then inspect /etc/kdump.conf for the path and target. Test with a sysrq-triggered crash only on expendable machines.
How is kdump different from systemd-coredump?
Yes, and they serve different layers. systemd-coredump catches userspace crashes per process, while kdump captures the whole kernel state on a panic. A box can easily produce one kind and not the other.
My /var/crash is huge, can I delete old dumps?
They are large by design, each a snapshot of RAM at panic time. Keep one or two recent ones for debugging and archive or delete the rest; monitoring /var/crash usage prevents a full root filesystem.
Notice an outdated path? Let us know.