Hi,

How to fin a 'kernel panic' error in a running a system. (It was an Interview question).

Thanks.

well, any kernel errors should be in the log files somewhere, sometimes this is an issue because the disks aren't mounted when the kernel panic occurs, hence no writing to the log files! Take a look at this: http://rhcelinuxguide.wordpress.com/...ardiac-arrest/

if you are using kdump it will create a dump file of any kernel information. However I am not sure where the log if located. But there are occasions where the kernel will panic when mounting the filesystem in which case no log will be created.

you can also check /var/log/messages.

This was a very nice link!

If the kernel is totally confused, it can be unable to write logs or be unwilling to take the chance because it is so confused.

That's why a dump to swap is so valuable - assuming that you have the tools and the skill to evaluate the dump, of course. That article referenced above gives good examples of tracing.

You should realize that a panic is almost always going to be from a bad driver or bad hardware. If you've been running along for months with no changes and your system starts to panic regularly, it's probably hardware.

If it is hardware, the most common guilty party is RAM. Bad RAM can send the kernel off into the flowers, trampling all over everything until it trips and realizes "Hey, I can't go THERE!" and panics.

Above all, remember Don't panic. That's the kernel's job - Jeff Liebermann

Hi,

Thanks for all your replies.

Just a simple scenario regarding kernel panic, consider i have deleted the vmlinuz file while the sys is running. what will happen immediately(will the system continue to run) and where can i find that the vmlinuz files was deleted(I mean thr logs).

Thanks.

Why dont you try out this scenario on a test system and let us know how it goes
AFAIK, when you delete a file it doesn't get logged anywhere. If its been done by some user, you need to analyse the bash_history for that user (s)