abrt-ccpp ignores MaxCrashReportsSize and creates a huge dump :(

Question

My abrt-ccpp service suddenly stopped capping the dumps at 10M and creates huge dumps - what am I missing? (I really haven't changed anything...)

my dumps folder:

sudo du -sh /home/tmp/abrt/*
12K     /home/tmp/abrt/ccpp-2016-10-07-01:22:40-1838
17G     /home/tmp/abrt/ccpp-2016-10-31-16:49:34-27695.new

services status:

service abrt-ccpp status
Redirecting to /bin/systemctl status  abrt-ccpp.service
abrt-ccpp.service - Install ABRT coredump hook
   Loaded: loaded (/usr/lib/systemd/system/abrt-ccpp.service; enabled)
   Active: active (exited) since Mon 2016-10-31 16:48:23 IST; 8min ago

service abrtd status
Redirecting to /bin/systemctl status  abrtd.service
abrtd.service - ABRT Automated Bug Reporting Tool
   Loaded: loaded (/usr/lib/systemd/system/abrtd.service; enabled)
   Active: active (running) since Mon 2016-10-31 16:48:22 IST; 8min ago

config:

grep MaxCrash /etc/abrt/abrt.conf
MaxCrashReportsSize = 10

system:

cat /etc/redhat-release
CentOS Linux release 7.1.1503 (Core)

and I just keep getting these:

Nov  3 10:40:55 node-02 abrt-hook-ccpp: Saved core dump of pid 21337 (Linux/Release/Flow) to /home/tmp/abrt/ccpp-2016-11-03-10:39:33-21337 (6489010176 bytes)

Answer 1

From https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/sect-abrt-configuration-abrt.html:

Once the quota specified here has been met, ABRT will continue catching problems, and in order to make room for the new crash dumps, it will delete the oldest and largest ones.

From my own observation, I think abrt stores the last coredump even if it's larger than the limit. I think the limit only decides whether it removes "old" dumps.