We have an in-house daemon running on a few RHEL 5 boxes which periodically segfaults. Our developers want a core file to help with debugging but I can't provoke it into producing one.

$ sudo grep segfault /var/log/messages.1
Aug 11 21:04:13 pal108 kernel: brokend[28692]: segfault at 00000000000000a8
rip 00000031d020f908 rsp 00007fff9c60f3f0 error 4

The daemon is started using daemon from /etc/init.d/functions, so adding


to its sysconfig file should set ulimit accordingly. This seems to be the case, according to procfs:

$ sudo grep core /proc/$(cat /var/run/brokend.pid)/limits
Max core file size        unlimited            unlimited            bytes  

And the core file pattern points to a location that exists:

$ cat /proc/sys/kernel/core_pattern

Yet it still won't produce a core file. Any ideas what might could be stopping this? Does a segfault always mean the OS will attempt to produce a core file or does it rely on some application-specific coding to do so?


Is the daemon setuid? setuid processes won't dump core files by default.

Run sysctl fs.suid_dumpable=1 to enable setuid dumps.

| improve this answer | |
  • Nope, not setuid. – markdrayton Aug 16 '10 at 19:03
  • Does the daemon call setuid() / seteuid() anywhere? Anything that does a setuid() is tainted and won't be dumped. – James Aug 16 '10 at 20:43
  • No mention of setuid()/seteuid() anywhere in the code or strace output. Argh! – markdrayton Aug 17 '10 at 7:03
  • The mystery deepens - how about setgid() and friends? Does the daemon call prctl() to disable core dumps at all? – James Aug 17 '10 at 8:46

Yes, coredumps always are written when a signal is sent to the process which produces a core f.e.:

   ABRT       6   core
   FPE        8   core
   ILL        4   core
   QUIT       3   core
   SEGV      11   core
   TRAP       5   core
   SYS            core      might not be implemented
   EMT            core      might not be implemented
   BUS            core      core dump might fail
   XCPU           core      core dump might fail
   XFSZ           core      core dump might fail

ulimit shoud be set (as you already mentioned). as i dont know redhat this much, i would check if the ulimit under the user you are running the deamon has it set to. i would just put a

echo -n "ulimit: "
ulimit -c
echo -n "For id: "
id -u

in the script to test it.

Check out "man core" there is an example code to test the coredump feature. At least under debian there is.

| improve this answer | |
  • Core dump behavior depends on the OS/Distribution you're running. They're disabled by default on OS X, and broken on Ubuntu if you have Apport installed: bugs.launchpad.net/ubuntu/+source/apport/+bug/160999 – Gerald Combs Aug 16 '10 at 15:46
  • Should sending a SIGSEGV make it dump? If so, it doesn't -- kill -11 <PID> == no core file :( – markdrayton Aug 16 '10 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.