To obtain more (core dump) from a Xen or KVM virtual machine using virsh, follow these steps:

1. Enable Crashkernel in GRUB (for CentOS/RHEL):

   For CentOS or Red Hat Enterprise Linux (RHEL), you'll need to enable crash kernel. Edit the /etc/default/grub file and add the crashkernel parameter. For example:

   makefile

Then, update GRUB:

• sudo grub2-mkconfig -o /boot/grub2/grub.cfg

  Reboot the system for the changes to take effect.

• Verify Kernel and Kexec-tools:

  Ensure that you have kexec-tools and a suitable kernel-debug package installed on your system.

  lua

Verify that the kexec service is enabled and running:

• sudo systemctl enable kexec-reboot sudo systemctl start kexec-reboot

• Crash the Virtual Machine:

  Simulate a kernel crash within the virtual machine. You can do this by running the following command inside the virtual machine:

   
• echo c > /proc/sysrq-trigger

• Monitor for Crash Event:

  Back on the hypervisor, monitor for the crash event using dmesg:

  Perl
• dmesg | grep "crash"

  You should see messages indicating a crash event.

• Capture more with virsh:

  Use virsh to capture the more:

  javascript
• sudo virsh dump <domain_name> /path/to/save/vmcore

  Replace <domain_name> with the name of your virtual machine.

• Analyzing the more:

  You can use tools like crash or gdb to analyze the vmcore. Install crash if it's not already installed:

   

Then use crash with the vmcore file: