Mailinglist Archive: opensuse (1151 mails)

< Previous Next >
Re: [opensuse] leap422 - where is my core dump?
On 2016-12-01 20:43, Ruediger Meier wrote:

On 12/01/2016 07:39 PM, Carlos E. R. wrote:
On 2016-12-01 17:49, Per Jessen wrote:
Patrick Shanahan wrote:

appears same in Tw:
08:11 Crash:~ > cat /proc/sys/kernel/core_pattern
|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %e
Somebody knows what means those options?
man core

Thanks :-)

%p PID of dumped process
%P ??
%u (numeric) real UID of dumped process
%g (numeric) real GID of dumped process
%s number of signal causing dump
%t time of dump, expressed as seconds since the Epoch, 1970-01-01
00:00:00 +0000 (UTC)
%e executable filename (without path prefix)

Now we need to know where the documentation for "systemd-coredump" is. I
don't have a man page. Ah, yes, I do, on a newer system:

systemd-coredump can be used as a helper binary by the kernel
when a user space program receives a fatal signal and dumps core. For it
to be used in this capacity, it must be specified by the
kernel.core_pattern sysctl(8) setting. Systemd installs
/usr/lib/sysctl.d/50-coredump.conf which configures kernel.core_pattern
to invoke systemd-coredump. This file may be masked or overridden to use
a different setting following normal sysctl.d(5) rules.

The behavior of a specific program upon reception of a signal is
governed by a few factors which are described in detail in core(5). In
particular, the coredump will only be processed when the related
resource limits are high enough. For programs started by systemd, those
may be set using LimitCore= (see systemd.exec(5)).

systemd-coredump will log the coredump including a backtrace if
possible, and store the core (contents of process' memory contents) in
an external file on disk in /var/lib/systemd/coredump, or directly in
the journal. This behavior may be modified using coredump.conf(5).

Apart from the journalctl(1) log viewer, coredumpctl(1) may be
used to list and extract coredumps.

And there is a corresponding coredump.conf and manual.

Isengard:~ # cat /usr/lib/sysctl.d/50-coredump.conf
# This file is part of systemd.
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.

# See sysctl.d(5) for the description of the files in this directory,
# and systemd-coredump(8) and core(5) for the explanation of the
# setting below.

kernel.core_pattern=|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %e
Isengard:~ #

Let's see the manual:

All options are configured in the "[Coredump]" section:

Controls where to store cores. One of "none", "external",
"journal", and "both". When "none", the coredumps will be logged but not
stored permanently. When "external" (the default), cores will be stored
in /var/lib/systemd/coredump. When "journal", cores will be stored in
the journal and rotated following normal journal rotation patterns. When
"both", cores will be stored in both locations.

When cores are stored in the journal, they might be
compressed following journal compression settings, see journald.conf(5).
When cores are stored externally, they will be compressed by default,
see below.

Controls compression for external storage. Takes a boolean
argument, which defaults to "yes".

The maximum size in bytes of a core which will be processed.
Coredumps exceeding this size will be logged, but the backtrace will not
be generated and the core will not be stored.

ExternalSizeMax=, JournalSizeMax=
The maximum (uncompressed) size in bytes of a core to be saved.

MaxUse=, KeepFree=
Enforce limits on the disk space taken up by externally
stored coredumps. MaxUse= makes sure that old coredumps are removed as
soon as the total disk space taken up by coredumps grows beyond this
limit (defaults to 10% of the total disk size). KeepFree= controls how
much disk space to keep free at least (defaults to 15% of the total disk
size). Note that the disk space used by coredumps might temporarily
exceed these limits while coredumps are processed. Note that old
coredumps are also removed based on time via systemd-tmpfiles(8).
Set either value to 0 to turn off size-based clean-up.

Mmmm... Seems "MaxUse" is a percent, not a size.

Ageing is controlled by systemd-tmpfiles, configured where? Maybe a file
in "/usr/lib/tmpfiles.d/

Isengard:~ # grep core /usr/lib/tmpfiles.d/*
/usr/lib/tmpfiles.d/systemd.conf:d /var/lib/systemd/coredump 0755 root
root 3d
Isengard:~ #

Ok, so the line is

d /var/lib/systemd/coredump 0755 root root 3d

man tmpfiles.d

The configuration format is one line per path containing type,
path, mode, ownership, age, and argument fields.

The permissions apply to the directory, not the contents. And they are
deleted after 3 days.

Still, I do not see how to control the permissions of the core files.

But the line

kernel.core_pattern=|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %e

would allow to set it differently to some other command. Perhaps create
our own script. In 13.1 it is:

cer@Telcontar:~> cat /proc/sys/kernel/core_pattern

So, perhaps from this information some one can think a way to customize
the permissions. I don't object to have cores centralized in a directory.

Cheers / Saludos,

Carlos E. R.
(from 13.1 x86_64 "Bottle" at Telcontar)

< Previous Next >
Follow Ups