Core dump file of vim.tiny generated.
search cancel

Core dump file of vim.tiny generated.

book

Article ID: 374818

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • You see an alarm similar to the following:

    An application on an edge node crashed, resulting in a core dump file of vim.tiny being generated.

  • It is confirmed the core dump is generated when opening "/etc/default/kdump-tools" file using vim.tiny tool.

    Core was generated by `vim.tiny /etc/default/kdump-tools'.
    Program terminated with signal SIGSEGV, Segmentation fault.
  • The syslog indicates that the core dump is generated in the ssh session from the specific client.

    <DATE_TIME> <HOSTNAME> kernel - - - [78725.005151] get_sigframe: 13 callbacks suppressed
    <DATE_TIME> <HOSTNAME> kernel - - - [78725.005153] signal: vim.tiny[57850] overflowed sigaltstack
    <DATE_TIME> <HOSTNAME> kernel - - - [78725.005156] signal: vim.tiny[57850] overflowed sigaltstack
     
    <DATE_TIME> <HOSTNAME> kernel - - - [78725.005164] grsec: From <CLIENT_IP_ADDRESS>: Segmentation fault occurred at 0000000000000000 in /usr/bin/vim.tiny[vim.tiny:57850] uid/euid:0/0 gid/egid:0/0, parent /[bash:57561] uid/euid:0/0 gid/egid:0/0
    <DATE_TIME> <HOSTNAME> NSX 691637 - [nsx@6876 comp="nsx-edge" subcomp="node-mgmt" username="root" level="WARNING"] Core file generated: /var/log/core/core.vim.tiny.1721816611.57850.0.11.gz

  • The audit log also shows that the creation/close time of the ssh session.

    <DATE_TIME> <HOSTNAME> sshd 57540 - -  Accepted password for root from <CLIENT_IP_ADDRESS> port 56516 ssh2
    <DATE_TIME> <HOSTNAME> sshd 57540 - -  pam_unix(sshd:session): session opened for user root by (uid=0)
    <DATE_TIME> <HOSTNAME> systemd-logind 3039 - -  New session <SESSION_ID> of user root.
     
    <DATE_TIME> <HOSTNAME> sshd 57540 - -  pam_unix(sshd:session): session closed for user root
    <DATE_TIME> <HOSTNAME> sshd 57540 - -  pam_systemd(sshd:session): Failed to release session: Interrupted system call
    <DATE_TIME> <HOSTNAME> systemd-logind 3039 - -  Removed session <SESSION_ID>.

Environment

VMware NSX-T Data Center 3.2.3.0.1

Resolution

It is not recommended to do any operations using root user on NSX appliances.