How do I enable core dumps for daemons (services) in Linux Reporter?

Products

• Reporter

Issue/Introduction

Issue

• For troubleshooting purposes, the client wants to generate core dumps when a daemon (service) terminates abnormally.
• The client wants to know why segfault happens.

Environment

• Red Hat® Enterprise Linux including:
  • Red Hat Enterprise Linux 3
  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 5

Resolution

Make the following modifications to enable core dumps for daemons:

• Edit /etc/profile:

  vi /etc/profile 

• Replace this line:

  ulimit -S -c 0 > /dev/null 2>&1

  with this line:

  ulimit -c unlimited >/dev/null 2>&1

• Enable this globally by editing the /etc/sysconfig/init file and add this line:

  DAEMON_COREFILE_LIMIT='unlimited'

• Note: Removing setting limits do not affect daemon processes which are already running, so the client needs to restart daemons that enable core dumps. Alternatively, the client can reboot the system to have new settings take effect for all daemons.

• By default, core dumps are not generated by programs that are running setuid to prevent sensitive information from being leaked. To enable core dumps for setuid programs (for the running kernel, not persistent over reboots):
  • For Red Hat Enterprise Linux 5: “suidsafe” (recommended) – protect privileged information by having the core dump be owned by and only readable for root:

    echo 2 > /proc/sys/fs/suid_dumpable

• For Red Hat Enterprise Linux 5: “debug” (may cause privileged information to be leaked):

  echo 1 > /proc/sys/fs/suid_dumpable

• For Red Hat Enterprise Linux 4:

  echo 2 > /proc/sys/kernel/suid_dumpable

• For Red Hat Enterprise Linux 3:

  echo 1 > /proc/sys/kernel/core_setuid_ok

• Changes to these /proc values take effect immediately (however these are not preserved upon reboot), so they will also apply to daemons that are already running.

• To enable core dumps for setuid programs (persistent over reboots):
  • Edit /etc/sysctl.conf and add the following:

    fs.suid_dumpable = 2      # RHEL 5 only kernel.suid_dumpable = 2  # RHEL 4 only kernel.core_setuid_ok = 1 # RHEL 3 only kernel.core_pattern = /tmp/core

• Reload the settings in /etc/sysctl.conf:

  sysctl -p

When the daemon terminates abnormally, a core file should appear in the configured location, /tmp. The exact location and name of the core file can be controlled through the kernel.core_pattern sysctl, which is documented in the core(5) manual page and /usr/share/doc/kernel-doc*/Documentation/sysctl/kernel.txt from the kernel-doc package.

Root Cause

• A daemon is a computer program that runs in the background, rather than under the direct control of a user; they are usually initiated as processes. Daemons are usually started with the service command or as an init script.