kdump is a kernel crash-dumping mechanism that utilizes the kexec software. The crash dumps are captured from the context of a booted kernel. Kdump uses kexec to boot into a second kernel whenever the system crashes. This second kernel, often called a capture kernel, boots with very little memory and captures the dump image. The first kernel reserves a section of memory that the second kernel uses to boot. Memory reserved for the kdump kernel at boot time cannot be used by the standard kernel, which changes the actual minimum memory requirements Linux. First off all install packages for capturing vmcore

[root@setenforce ~]# yum -y install kexec-tools kernel-kdump

If you want to use kdump you have to change boot parameters in /boot/grub/grub. conf First of all you have to calculate crashkernel parameters. For RHEL5 crashkernel is defined on next way crashkernel=memory@offset. Below you can find a table which will show you possible values in memory and offset (use this just as a guide)

RAM size Memory Offset
0 - 2G 128M 16M
2G - 6G 256M 24M
6G - 8G 512M 16M
8G - 24G 768M 32M

If RAM size is greater than 24G try memory 768M and offset of 32M. As this is just a guide you can find that have to increase some of parameters according to your system. Now I will try to help to calculate best parameters for your machine (on my example)

[root@setenforce ~]# egrep "^ .*|System RAM" /proc/iomem | sed -e 's/ : / /g' -e 's/-/ /g' | awk '{;printf("%d bytes to %d bytes (%d M to %d M) - %s %s\n", strtonum("0x"$1), strtonum("0x"$2), strtonum("0x"$1)/1024/1024, strtonum("0x"$2)/1024/1024, $3, $4)}'

You will get something like this

65536 bytes to 653311 bytes (0 M to 0 M) - System RAM
1048576 bytes to 3220111359 bytes (1 M to 3070 M) - System RAM
16777216 bytes to 21233032 bytes (16 M to 20 M) - Kernel code
21233033 bytes to 28537263 bytes (20 M to 27 M) - Kernel data
30322688 bytes to 35832439 bytes (28 M to 34 M) - Kernel bss
67108864 bytes to 872415231 bytes (64 M to 831 M) - Crash kernel
3220176896 bytes to 3221225471 bytes (3071 M to 3071 M) - System RAM

According to this the offset can start anywhere from 34M upwards, and must not go over 3070M. From earlier experience, (as my machine has 16GB RAM) i added crashkernel=768M@64M in /boot/grub/grub.conf. So kernel line looks like this one

kernel /boot/vmlinuz-2.6.17-1.2519.4.21.el5 ro root=LABEL=/ rhgb quiet crashkernel=768M@64M

We will dump files in /var/crash directory, so I remove comment in next lines from /etc/kdump.conf

path /var/crash
core_collector makedumpfile -c --message-level 1 -d 31
[root@setenforce ~]# chkconfig kdump on

Reboot machine. Next time when kernel panic occures you will find vmcore in /var/crash directory.