2

We have an in-house daemon running on a few RHEL 5 boxes which periodically segfaults. Our developers want a core file to help with debugging but I can't provoke it into producing one.

$ sudo grep segfault /var/log/messages.1
Aug 11 21:04:13 pal108 kernel: brokend[28692]: segfault at 00000000000000a8
rip 00000031d020f908 rsp 00007fff9c60f3f0 error 4

The daemon is started using daemon from /etc/init.d/functions, so adding

DAEMON_COREFILE_LIMIT=unlimited

to its sysconfig file should set ulimit accordingly. This seems to be the case, according to procfs:

$ sudo grep core /proc/$(cat /var/run/brokend.pid)/limits
Max core file size        unlimited            unlimited            bytes

And the core file pattern points to a location that exists:

$ cat /proc/sys/kernel/core_pattern
"/tmp/core_%p_%e_%t"

Yet it still won't produce a core file. Any ideas what might could be stopping this? Does a segfault always mean the OS will attempt to produce a core file or does it rely on some application-specific coding to do so?

Improve this question

2 Answers 2

Reset to default
3

Is the daemon setuid? setuid processes won't dump core files by default.

Run sysctl fs.suid_dumpable=1 to enable setuid dumps.

Improve this answer
4
  • Nope, not setuid.
    – markdrayton
    Aug 16, 2010 at 19:03
  • Does the daemon call setuid() / seteuid() anywhere? Anything that does a setuid() is tainted and won't be dumped.
    – James
    Aug 16, 2010 at 20:43
  • No mention of setuid()/seteuid() anywhere in the code or strace output. Argh!
    – markdrayton
    Aug 17, 2010 at 7:03
  • The mystery deepens - how about setgid() and friends? Does the daemon call prctl() to disable core dumps at all?
    – James
    Aug 17, 2010 at 8:46
0

Yes, coredumps always are written when a signal is sent to the process which produces a core f.e.:

   ABRT       6   core
   FPE        8   core
   ILL        4   core
   QUIT       3   core
   SEGV      11   core
   TRAP       5   core
   SYS            core      might not be implemented
   EMT            core      might not be implemented
   BUS            core      core dump might fail
   XCPU           core      core dump might fail
   XFSZ           core      core dump might fail

ulimit shoud be set (as you already mentioned). as i dont know redhat this much, i would check if the ulimit under the user you are running the deamon has it set to. i would just put a 

echo -n "ulimit: "
ulimit -c
echo -n "For id: "
id -u
echo

in the script to test it.

Check out "man core" there is an example code to test the coredump feature. At least under debian there is.

Improve this answer
2
  • Core dump behavior depends on the OS/Distribution you're running. They're disabled by default on OS X, and broken on Ubuntu if you have Apport installed: bugs.launchpad.net/ubuntu/+source/apport/+bug/160999
    – Gerald Combs
    Aug 16, 2010 at 15:46
  • Should sending a SIGSEGV make it dump? If so, it doesn't -- kill -11 <PID> == no core file :(
    – markdrayton
    Aug 16, 2010 at 19:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .