How to enable core dump collection in Linux for every user ?

Today we will look at an interesting and useful topic to understand what is core dump and how to collect it for all programs executed under different users in Linux.

To understand it better, lets go ahead and take a look on this step by step.

Introduction

1. What is core dump ?
A core dump is a file generated by few termination signals that contains the process memory content.
It helps us to diagnose why the particular process is killed.

Whenever a process is abruptly killed by system due to a fault, it generates the core file.
For example:- process is trying to access the invalid memory address.

2. How to debug a core file ?
We can debug the generated core file using gdb i.e. GNU Debugger to analyze what has caused the panic.

3. Which signal generates the core file ?
Signal “Core”: Terminates the process and generates core file.

4. How to generate core dump of a running process ?
We can press Ctrl + \ to generate a core dump file of the running process.

 

Enabling Core dump in Linux.

1. By default, the core dump is disabled in linux.
We can check the status by ulimit command, if “core file size” parameter value is 0, it means the core dump is disabled on server.

[nglinux@nglinux ~]$ ulimit -a
core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 7754
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited

2. Verify no startup file has command “ulimit -c 0”
The second thing is to check all startup files, they must not define any ulimit command which disables the core file.

[root@nglinux ~]# grep -i ulimit /etc/profile ~/.bashrc ~/.bash_profile ~/.profile /etc/rc3.d/*
grep: /root/.profile: No such file or directory
[root@nglinux ~]# 

3. Enable Core dump globally on system.
Put the last line “* soft core unlimited” to enable the core dump on our system.

[root@nglinux ~]# tail /etc/security/limits.conf 
#*               soft    core            0
#*               hard    rss             10000
#@student        hard    nproc           20
#@faculty        soft    nproc           20
#@faculty        hard    nproc           50
#ftp             hard    nproc           0
#@student        -       maxlogins       4
* soft core unlimited

4. Enable core dump for a user.

### Check the core dump file size for your user.
[root@nglinux ~]# ulimit -c
0

### Increase the limit to 102400 KB.
[root@nglinux ~]# ulimit -c 102400
[root@nglinux ~]# ulimit -c
102400
[root@nglinux ~]# 

### Now check the size again
[root@nglinux ~]# ulimit -a
core file size          (blocks, -c) 102400

### You can see below function defined on your system.
### You can also define DAEMON_COREFILE_LIMIT='unlimited' or 1024000 before this line as per requirement.
[root@nglinux init.d]# cat functions | grep -i ulimit
	corelimit="ulimit -S -c ${DAEMON_COREFILE_LIMIT:-0}"
[root@nglinux init.d]# pwd
/etc/init.d
[root@nglinux init.d]# 

5. Restart the server and now the limit is set for all users:

[nglinux@nglinux ~]$ ulimit -a
core file size          (blocks, -c) 102400
data seg size           (kbytes, -d) unlimited

5. Set the core file path and name pattern.

### You have to define this in /etc/sysctl.conf for changing the core file path permanently.
[root@nglinux ~]# sysctl -w kernel.core_pattern=/var/crash/core.%u.%e.%p
kernel.core_pattern = /var/crash/core.%u.%e.%p
[root@nglinux ~]# 

### Check the settings in below file:
[root@nglinux ~]# cat /proc/sys/kernel/core_pattern 
/var/crash/core.%u.%e.%p
[root@nglinux ~]# 

 

Generating Core file

6. Generate a core file.

[root@nglinux ~]# kill -ABRT 3835
[root@nglinux ~]# ls -ltr /var/crash/
total 312
-rw-------. 1 root root 581632 Jul  9 23:59 core.0.top.3835
[root@nglinux ~]# 

### Another way of generating core
[root@nglinux ~]# kill -SIGSEGV 3848

[root@nglinux ~]# ls -ltr /var/crash
total 624
-rw-------. 1 root root 581632 Jul  9 23:59 core.0.top.3835
-rw-------. 1 root root 581632 Jul 10 00:01 core.0.top.3848
[root@nglinux ~]# 

SIGSEGV and SIGABRT are some of the signals we have used above for generating the core file by killing the program abruptly.
These signals have below meaning:

SIGSEGV 	kill a process with invalid memory address access (segmentation fault)
SIGABRT 	abort a program i.e. abnormal exit, it is initiated by abort()

Leave a Reply

Your email address will not be published.