How to enable core dump collection in Linux for every user ?
Today we will look at an interesting and useful topic to understand what is core dump and how to collect it for all programs executed under different users in Linux.
To understand it better, lets go ahead and take a look on this step by step.
Introduction
1. What is core dump ?
A core dump is a file generated by few termination signals that contains the process memory content.
It helps us to diagnose why the particular process is killed.
Whenever a process is abruptly killed by system due to a fault, it generates the core file.
For example:- process is trying to access the invalid memory address.
2. How to debug a core file ?
We can debug the generated core file using gdb i.e. GNU Debugger to analyze what has caused the panic.
3. Which signal generates the core file ?
Signal “Core”: Terminates the process and generates core file.
4. How to generate core dump of a running process ?
We can press Ctrl + \ to generate a core dump file of the running process.
Enabling Core dump in Linux.
1. By default, the core dump is disabled in linux.
We can check the status by ulimit command, if “core file size” parameter value is 0, it means the core dump is disabled on server.
[nglinux@nglinux ~]$ ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 7754 max locked memory (kbytes, -l) 64 max memory size (kbytes, -m) unlimited
2. Verify no startup file has command “ulimit -c 0”
The second thing is to check all startup files, they must not define any ulimit command which disables the core file.
[root@nglinux ~]# grep -i ulimit /etc/profile ~/.bashrc ~/.bash_profile ~/.profile /etc/rc3.d/* grep: /root/.profile: No such file or directory [root@nglinux ~]#
3. Enable Core dump globally on system.
Put the last line “* soft core unlimited” to enable the core dump on our system.
[root@nglinux ~]# tail /etc/security/limits.conf #* soft core 0 #* hard rss 10000 #@student hard nproc 20 #@faculty soft nproc 20 #@faculty hard nproc 50 #ftp hard nproc 0 #@student - maxlogins 4 * soft core unlimited
4. Enable core dump for a user.
### Check the core dump file size for your user.
[root@nglinux ~]# ulimit -c
0
### Increase the limit to 102400 KB.
[root@nglinux ~]# ulimit -c 102400
[root@nglinux ~]# ulimit -c
102400
[root@nglinux ~]#
### Now check the size again
[root@nglinux ~]# ulimit -a
core file size (blocks, -c) 102400
### You can see below function defined on your system.
### You can also define DAEMON_COREFILE_LIMIT='unlimited' or 1024000 before this line as per requirement.
[root@nglinux init.d]# cat functions | grep -i ulimit
corelimit="ulimit -S -c ${DAEMON_COREFILE_LIMIT:-0}"
[root@nglinux init.d]# pwd
/etc/init.d
[root@nglinux init.d]#
5. Restart the server and now the limit is set for all users:
[nglinux@nglinux ~]$ ulimit -a core file size (blocks, -c) 102400 data seg size (kbytes, -d) unlimited
5. Set the core file path and name pattern.
### You have to define this in /etc/sysctl.conf for changing the core file path permanently. [root@nglinux ~]# sysctl -w kernel.core_pattern=/var/crash/core.%u.%e.%p kernel.core_pattern = /var/crash/core.%u.%e.%p [root@nglinux ~]# ### Check the settings in below file: [root@nglinux ~]# cat /proc/sys/kernel/core_pattern /var/crash/core.%u.%e.%p [root@nglinux ~]#
Generating Core file
6. Generate a core file.
[root@nglinux ~]# kill -ABRT 3835 [root@nglinux ~]# ls -ltr /var/crash/ total 312 -rw-------. 1 root root 581632 Jul 9 23:59 core.0.top.3835 [root@nglinux ~]# ### Another way of generating core [root@nglinux ~]# kill -SIGSEGV 3848 [root@nglinux ~]# ls -ltr /var/crash total 624 -rw-------. 1 root root 581632 Jul 9 23:59 core.0.top.3835 -rw-------. 1 root root 581632 Jul 10 00:01 core.0.top.3848 [root@nglinux ~]#
SIGSEGV and SIGABRT are some of the signals we have used above for generating the core file by killing the program abruptly.
These signals have below meaning:
SIGSEGV kill a process with invalid memory address access (segmentation fault) SIGABRT abort a program i.e. abnormal exit, it is initiated by abort()