In a system that for a reason is unstable it seems to be very useful to save and check the core files that can be produced by its processes or by its kernel. By default in redhat 7 systems and I think in other linux distributions as well, this is disabled. So, we need to enable core dumps in our system.
In case you have a redhat subscription you can also check the following very useful article:
But you can find here and there other solutions. I’ll share my own alternate method on how to enable core dumps in an RHEL 7 or similar linux system. All you have to do is to follow the steps bellow.
- Create a directory (I choosed /opt/corefiles) where you want the core files to be stored and give it the permissions of 777:
[root@system ~]# mkdir /opt/corefiles [root@system ~]# chmod 0777 /opt/corefiles
- Edit /etc/security/limits.conf and add the following line entry at the bottom of the file (before # End of file)
* soft core unlimited
The ending of the specific file should be like this:
# * soft core unlimited #* soft core 0 #* hard rss 10000 #@student hard nproc 20 #@faculty soft nproc 20 #@faculty hard nproc 50 #ftp hard nproc 0 #@student - maxlogins 4 # End of file
- The next step, is to set some sysctl parameters. The best approach on this in my opinion is to create a sysctl conf under /etc/sysctl.d directory. This file should contain a syntax like param = value and the file should have a .conf as extension. You can use a naming convention like the one I used ‘100-cores.conf’ and add the following content.
Linux uses the numbering convention to prioritize them. Most noteworthy, you have to set in kernel.core_pattern the directory you previously created.
[root@system ~]# cat /etc/sysctl.d/100-cores.conf kernel.core_pattern = /opt/corefiles/core.%e.%t.%p kernel.core_pipe_limit = 0 kernel.core_uses_pid = 0 fs.suid_dumpable = 1
- Finally, you should reboot your system for the changes to apply
In conclusion, it is very important in system administration to verify that your work is done below it will be a demo on this.
- Check ulimit core file size value. It should be unlimited.
[root@system ~]# ulimit -c unlimited
- Check the sysctl params that you previously set
[root@system ~]# sysctl -a | egrep 'kernel.core|suid_dumpable' fs.suid_dumpable = 1 kernel.core_pattern = /opt/corefiles/core.%e.%t.%p kernel.core_pipe_limit = 0 kernel.core_uses_pid = 1
- Force a kernel panic 🙂
[root@system ]# echo c > /proc/sysrq-trigger
- Wait the system to reboot and check that the core file exists
[root@system corefiles]# ls -lah total 195M drwxrwxrwx 2 root root 4.0K Apr 19 07:05 . drwxr-xr-x 8 root root 4.0K Apr 19 07:05 .. -rw-r--r-- 1 root root 195M Apr 19 08:58 vmcore-1492617527.tar [root@system corefiles]#