Do segfaults always try to dump core?

Question

We have an in-house daemon running on a few RHEL 5 boxes which periodically segfaults. Our developers want a core file to help with debugging but I can't provoke it into producing one.

$ sudo grep segfault /var/log/messages.1
Aug 11 21:04:13 pal108 kernel: brokend[28692]: segfault at 00000000000000a8
rip 00000031d020f908 rsp 00007fff9c60f3f0 error 4

The daemon is started using daemon from /etc/init.d/functions, so adding

DAEMON_COREFILE_LIMIT=unlimited

to its sysconfig file should set ulimit accordingly. This seems to be the case, according to procfs:

$ sudo grep core /proc/$(cat /var/run/brokend.pid)/limits
Max core file size        unlimited            unlimited            bytes

And the core file pattern points to a location that exists:

$ cat /proc/sys/kernel/core_pattern
"/tmp/core_%p_%e_%t"

Yet it still won't produce a core file. Any ideas what might could be stopping this? Does a segfault always mean the OS will attempt to produce a core file or does it rely on some application-specific coding to do so?

score 3 · Answer 1 · answered Aug 16 '10 at 18:21

3

Is the daemon setuid? setuid processes won't dump core files by default.

Run sysctl fs.suid_dumpable=1 to enable setuid dumps.

answered Aug 16 '10 at 18:21

James

7,643
2
24
33

Nope, not setuid. – markdrayton Aug 16 '10 at 19:03
Does the daemon call setuid() / seteuid() anywhere? Anything that does a setuid() is tainted and won't be dumped. – James Aug 16 '10 at 20:43
No mention of setuid()/seteuid() anywhere in the code or strace output. Argh! – markdrayton Aug 17 '10 at 07:03
The mystery deepens - how about setgid() and friends? Does the daemon call prctl() to disable core dumps at all? – James Aug 17 '10 at 08:46

score 0 · Answer 2 · edited Aug 16 '10 at 13:04

Yes, coredumps always are written when a signal is sent to the process which produces a core f.e.:

   ABRT       6   core
   FPE        8   core
   ILL        4   core
   QUIT       3   core
   SEGV      11   core
   TRAP       5   core
   SYS            core      might not be implemented
   EMT            core      might not be implemented
   BUS            core      core dump might fail
   XCPU           core      core dump might fail
   XFSZ           core      core dump might fail

ulimit shoud be set (as you already mentioned). as i dont know redhat this much, i would check if the ulimit under the user you are running the deamon has it set to. i would just put a

echo -n "ulimit: "
ulimit -c
echo -n "For id: "
id -u
echo

in the script to test it.

Check out "man core" there is an example code to test the coredump feature. At least under debian there is.

Core dump behavior depends on the OS/Distribution you're running. They're disabled by default on OS X, and broken on Ubuntu if you have Apport installed: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/160999 — Gerald Combs, Aug 16 '10 at 15:46
Should sending a SIGSEGV make it dump? If so, it doesn't -- kill -11 == no core file :( — markdrayton, Aug 16 '10 at 19:04

Do segfaults *always* try to dump core?

2 Answers2

Do segfaults always try to dump core?