Running a pretty standard Fedora 25 system I expect that the core files of all segfaulting processes are collected by ABRT. But this doesn't seem to be the case.

ABRT is enabled:

cat /proc/sys/kernel/core_pattern
|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t %P %I

A self-test does work of a simple user segfault works:

sleep 100 &
kill -11 $!
[1]  + segmentation fault (core dumped)  sleep 100

And a directory containing the core file under /var/spool/abrt is generated (i.e. ccpp-YYYY-MM-DD...).

Also the journal records:

Jan 01 21:38:12 example.org audit[17183]: ANOM_ABEND auid=1000 uid=0 gid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=17183 comm="sleep" exe="/usr/bin/sleep" sig=11
Jan 01 21:38:12 example.org abrt-hook-ccpp[17186]: Process 17183 (sleep) of user 0 killed by SIGSEGV - dumping core

But when an opensshd process segfaults then the abrt hook doesn't get invoked and thus there is no core file.

The journal entries for the opensshd core:

Jan 01 21:41:46 example.org audit[18256]: ANOM_ABEND auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 pid=18256 comm="sshd" exe="/usr/sbin/sshd" sig=11
Jan 01 21:41:46 example.org kernel: traps: sshd[18256] general protection ip:7f4d8d16ffd1 sp:7ffd42d93ef0 error:0 in libc-2.24.so[7f4d8d0ef000+1bd000]

Is this an ABRT bug or a feature?

That means is the core file collection for system daemons disabled, by default?

And how do I enable it?

  • 1
    do the daemons have cores enabled in /etc/security/limits.conf? – apricot boy Jan 2 '17 at 0:14
  • @apricotboy, the sshd is started via systemctl and thus running as root, I presume. There are no entries for special users in /etc/security/limits.conf. – maxschlepzig Jan 2 '17 at 8:24
  • @Jakuje, it is the sshd from the standard fedora repository, installed by default. – maxschlepzig Jan 2 '17 at 8:25
  • @Jakuje, yes, I wrote that report - it mentions openssh-7.3p1-7.fc25.x86_64 for the server (sshd) - but 7.4 just for the client. – maxschlepzig Jan 2 '17 at 8:30
  • oh ... my bad. Sorry for the noise. – Jakuje Jan 2 '17 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.