UNIX Consulting and Expertise
Golden Apple Enterprises Ltd. » Page 'Capturing core files in Red Hat Enterprise Linux'

Capturing core files in Red Hat Enterprise Linux

Looking for UNIX and IT expertise? Why not get in touch and see how we can help?

Capturing core files in Solaris is pretty straightforward – even more so if you’ve used JASS to secure the system. By default JASS will give you a nice /etc/coreadm.conf file:


This ensures that we keep all our core files in a sensible place, and that they have enough information in the filename to identify where they came from.

With some visualisation applications required Linux – more specifically Red Hat Enterprise Linux (RHEL), you’ll find the handy coreadm tool missing. Core file management is instead configured in the kernel configuration file, /etc/sysctl.conf

We’ve got three main challenges in RHEL:

  1. enable core dumps from setuid processes
  2. remove file size limits for core dumps
  3. stick them all in a sensible place, and give the core files sensible names

To accomplish all of this, we need to add the following lines into /etc/sysctl.conf:

fs.suid_dumpable = 2
kernel.core_pattern = /var/corecore_%h_%e_%u_%g_%t_%p

And then to make sure we aren’t imposing limits on our core files, we add the following to /etc/sysconfig/init:

DAEMON_COREFILE_LIMIT='unlimited'	# don't limit our core file sizes

Luckily there’s just a couple of differences between Solaris and Linux when it comes to naming our core files:

Solaris Variable Linux
%n nodename %n
%f executable name %e
%u UID %u
%g GID %g
%t epoch time %t
%p PID %p

Once you’ve updated /etc/sysctl.conf we can just refresh our settings by running sysctl:

[[email protected] ~]# /sbin/sysctl -p
< list of kernel tunables >
fs.suid_dumpable = 2
kernel.core_pattern = /var/core/core_%h_%e_%u_%g_%t_%p
< list of kernel tunables >
Like this post? Spread the word!
delicious digg google
stumbleupon technorati Yahoo!

One comment to “Capturing core files in Red Hat Enterprise Linux”

  1. usefull article.

    small type here:
    kernel.core_pattern = /var/corecore_%h_%e_%u_%g_%t_%p

    should be
    kernel.core_pattern = /var/core/core_%h_%e_%u_%g_%t_%p

    this directory has to be big enough to hold the whole memory of the process. 6.8 Gig in my case :-)

Top of page / Subscribe to new Entries (RSS)