1. In CentOS/RHEL core file creation is disabled by default. To enable it, executing the below command:
# ulimit -S -c unlimited > /dev/null 2>&1
then execute the program in the same shell environment.
2. To enable it permanently, please follow steps below:
– Edit /etc/security/limits.conf.
# vi /etc/security/limits.conf * soft core unlimited
The ‘*‘ is used to enable coredump size to unlimited to all users.
– Edit /etc/sysctl.conf to add the path of the core dump and file format of the core file. By default, the core file will be generated in the working directory of the running process.
# vi /etc/sysctl.conf kernel.core_pattern = /var/crash/core.%e.%p.%h.%t
/var/crash is the path and core.%e.%p.%h.%t is the file format, where:
%e – executable filename.
%p – PID of dumped process.
%t – time of dump (seconds since 0:00h, 1 Jan 1970).
%h – hostname (same as ’nodename’ returned by uname(2)).
Make sure processes have the correct permission for the configured directory (e.g. /var/carsh/).
– Set fs.suid_dumpable for setuid or otherwise protected/tainted binaries.
# vi /etc/sysctl.conf fs.suid_dumpable = 2
Following is the meaning of each predefined value:
- 0 – (default): traditional behaviour. Any process which has changed privilege levels or is execute only will not be dumped.
- 1 – (debug): all processes dump core when possible. The core dump is owned by the current user and no security is applied. This is intended for system debugging situations only.
- 2 – (suidsafe): any binary which normally not be dumped is dumped readable by root only. This allows the end-user to remove such a dump but not access it directly. For security reasons, core dumps in this mode will not overwrite one another or other files. This mode is appropriate when administrators are attempting to debug problems in a normal environment.
– Load the settings using the sysctl command below after modifying /etc/sysctl.conf below:
# sysctl -p
To collect core dumps from unsigned packages, set OpenGPGCheck = no in /etc/abrt/abrt-action-save-package-data.conf. To collect core dumps from unpackaged software, set ProcessUnpackaged = yes in /etc/abrt/abrt-action-save-package-data.conf
– Restart the abrtd daemon – as root – for the new settings to take effect.
# service abrtd restart # service abrt-ccpp restart
In CentOS/RHEL 7:
# systemctl start abrtd.service # systemctl start abrt-ccpp.service
Now, CentOS/RHEL is ready to generate core dump files when processes abandoned with segfault.