Fedora Core Dumps

Core dump files are basically a snapshot of the memory being used by an application at the time the crash occurred. On Fedora, core dumps are not enabled by default.

To enable core dumps:

$ ulimit -c unlimited

To check if core dumps are enabled, examine output of the command ulimit -c. It should be unlimited.

$ ulimit -c
unlimited

To make the change permanent for everybody, as root edit the file /etc/security/limits.conf and add the following line:

*     soft     core         unlimited

The asterisk (*) indicates that this applies for all users. This is generally a bad idea as you could end up with a lot of core dumps in various locations. To make this change for only a specific user, replace the asterisk with a username. For example, if the username is cmr, enter:

cmr      soft     core         unlimited

Core dumps are stored by default in the directory in which the application was running. To place core dumps in another location or to give a different name to core dumps, you must configure the sysctl variable kernel.core_pattern. The value of this variable can be checked as follows:

$ sudo sysctl -a | grep core_pattern
kernel.core_pattern = core

If you cannot locate a core dump after a crash, check if ABRT is installed and operational. ABRT (Automatic Bug Reporting Tool – previously known as CrashCatcher) is an application included in Fedora 11 and later that can be used to report details of application crashes to a bug reporting system. ABRT’s main configuration file is /etc/abrt/abrt.conf. As part of the reporting process, ABRT changes the default location of core dumps to /var/cache/abrt.

To check whether the ABRT daemon (abrtd) is running:

$ sudo service abrtd status or #sudo service abrtd status
abrt is stopped

To start the ABRT daemon:

$ sudo service abrtd start                                    [  OK  ]

When ABRT is running, the value of the sysctl variable kernel.core_pattern changes:

$ sysctl -a | grep core_pattern
kernel.core_pattern =| /usr/libexec/abrt-hook-ccpp /var/cache/abrt %p %s %u %c

ABRT creates a separate sub-directory for each crash under /var/cache/abrt. The core dump is stored in that sub-directory along with other files created by ABRT which may help in debugging the crash issue.

By default, ABRT only creates core dumps for those executables that were installed using RPM, i.e. belong to an RPM package. To enable support for other executables such as locally compiled code, simply edit /etc/abrt/abrt.conf and change the value of ProcessUnpackaged directive (default is no) to yes. You can also tell ARBT to ignore crashes for specific executables or in specific subdirectories by editing the BlackListedPaths directive.

By the way, you can set up ABRT so that crash reports are sent to a dedicated system for further processing. See the Red Hat Deployment Guide for details on how to do that.