Collecting a kernel coredump with macOS 10.15

Question

Created Apr ’20

Replies 2

Boosts 0

Views 2.9k

Participants 2

Does anyone have some pointers on how to collect a kernel coredump using macOS 10.15 for both the debug Mac and the Mac running the kernel coredump daemon (kdumpd)?

I can collect a kernel coredump using Mac OS 10.11 for the kernel coredump daemon from a kernel panic on macOS 10.15 but have been unable to run the daemon on macOS 10.15.

One of the setup steps for setting up the daemon is to create a directory at /PanicDumps. This is obviously not possible unless you temporarily boot using another startup volume or boot into Recovery Mode. Even if you do manage to create a directory at /PanicDumps, it is part of a read only file system so the kdumpd daemon will not be able to write to it.

If I instead create the directory on the " - Data" volume of the volume group, it does not appear when I boot back into 10.15.

Is there a new location for the PanicDumps directory?

Thanks so much for your help,

Tim Standing

Other World Computing, Inc.

Answered by DTS Engineer in 413415022

One of the setup steps for setting up the daemon is to create a directory at
/PanicDumps
.

I can see a couple of options here:

You could copy

/System/Library/LaunchDaemons/com.apple.kdumpd.plist

into

/Library/LaunchDaemons/

and then modify the directory argument.

You could use a use a synthetic symlink, per the
```
synthetic.conf
```
man page.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Apr ’20

Accepted Answer

One of the setup steps for setting up the daemon is to create a directory at
/PanicDumps
.

I can see a couple of options here:

You could copy

/System/Library/LaunchDaemons/com.apple.kdumpd.plist

into

/Library/LaunchDaemons/

and then modify the directory argument.

You could use a use a synthetic symlink, per the
```
synthetic.conf
```
man page.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 2

tstanding OP

Apr ’20

This is so awesome!!! It worked first try. Thank you. I chose the first of your two options.

In summary, my steps were:

First I made sure that the kdumpd wasn't running (from my previous attempts):

standing@Zippy ~ %sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.kdumpd.plist

Then I copied the com.apple.kdumpd.plist to /Library/LaunchDaemons:

sudo cp /System/Library/LaunchDaemons/com.apple.kdumpd.plist /Library/LaunchDaemons/

I then created the PanicDumps directory inside /Library:

standing@Zippy ~ % sudo mkdir /Library/PanicDumps

standing@Zippy ~ % sudo chmod 1777 /Library/PanicDumps

I changed the ProgramArguments parameter to point to the new location. The com.apple.kdumpd.plist now reads:

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<true/>

<key>InitGroups</key>

<true/>

<key>Label</key>

<string>com.apple.kdumpd</string>

<key>ProgramArguments</key>

<array>

<string>/usr/libexec/kdumpd</string>

<string>/Library/PanicDumps</string>

</array>

<key>Sockets</key>

<dict>

<key>Listener</key>

<dict>

<key>SockServiceName</key>

<key>SockType</key>

<string>dgram</string>

</dict>

<key>UserName</key>

<string>nobody</string>

<key>Umask</key>

<key>inetdCompatibility</key>

<dict>

<true/>

</dict>

</plist>

Lastly, I loaded the daemon using launchctl:

standing@Zippy ~ % sudo launchctl load -w /Library/LaunchDaemons/com.apple.kdumpd.plist

0