Redirect a core dump file to a specified directory (Linux)

Products

• Carbon Black App Control (formerly Cb Protection)
• Carbon Black EDR (formerly Cb Response)
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Workload
• Carbon Black EDR
• VMware Carbon Black

Issue/Introduction

How to redirect a core dump file to a specified directory.

Environment

• Linux OS: All Supported Versions

Resolution

1. If the "ABRT" package is installed.
   1. Check if ABRT is installed and running with

service abrt-ccpp status

                  and/or

rpm -qa | grep abrt

2. Install ABRT

yum install abrt

3. By default "abrt" will put core dumps into /var/spool/abrt/<subdir>
4. Change the location of core dumps by editing /etc/abrt/abrt.conf and setting "DumpLocation = <Path>"
5. When a core dump is generated you should see a message in /var/log/messages.

2.  If ABRT is not installed.
   1. By default core files will go into the cwd of the executable as long as "ulimit -c" is not 0.
   2. To enable core dumps add "ulimit -c unlimited" to you .bashrc file.
   3. To change the location of cure dumps execute "sysctl kernel.core_pattern=<directory>/<file-pattern>"

Additional Information

• See "man core" in Linux man help.
• File pattern may contain special characters to include things like process ID. See "man core".