CompTIA Linux+ XK0-006 (V8) Practice Question

The correct answer is kdump. kdump is a kernel crash dumping mechanism that captures the system's memory state (a vmcore or crash dump) in the event of a kernel panic. It works by booting into a secondary, smaller kernel (a capture kernel) which then saves the memory image of the crashed kernel to a file for later analysis with tools like crash. dmesg is used to view the kernel ring buffer, which contains kernel messages. While it may show the panic message, it does not capture the entire memory state for detailed analysis. journalctl is used to query the systemd journal. Similar to dmesg, it provides access to logged messages but is not the tool that captures the memory dump itself. rsyslog is a service for processing and forwarding log messages, not for creating crash dumps.