Location of core files in Arch Linux

· klm's blog

In Arch Linux the core file is no longer in the current directory. But rather it is under /var/lib/systemd/coredump.

Original post is here: eklausmeier.goip.de

In the old UNIX days the core file was written where the offending program was started. The only prerequisite was that there was no limit imposed. Limits can be checked by

 1$ ulimit -a
 2-t: cpu time (seconds)              unlimited
 3-f: file size (blocks)              unlimited
 4-d: data seg size (kbytes)          unlimited
 5-s: stack size (kbytes)             8192
 6-c: core file size (blocks)         unlimited
 7-m: resident set size (kbytes)      unlimited
 8-u: processes                       254204
 9-n: file descriptors                1024
10-l: locked-in-memory size (kbytes)  8192
11-v: address space (kbytes)          unlimited
12-x: file locks                      unlimited
13-i: pending signals                 254204
14-q: bytes in POSIX msg queues       819200
15-e: max nice                        0
16-r: max rt priority                 0
17-N 15: rt cpu time (microseconds)   unlimited

The line for the "core file size" must be greater than zero.

In Arch Linux that alone doesn't help. core files are written to this directory:

 1$ coredumpctl info
 2          PID: 16354 (h2o)
 3           UID: 33 (http)
 4           GID: 33 (http)
 5        Signal: 11 (SEGV)
 6     Timestamp: Wed 2024-04-10 20:02:12 CEST (2h 3min ago)
 7  Command Line: h2o
 8    Executable: /usr/bin/h2o
 9 Control Group: /user.slice/user-1000.slice/user@1000.service/tmux-spawn-3fc3de1b-6e2d-43bf-ad3d-bf55b4ce3a1a.scope
10          Unit: user@1000.service
11     User Unit: tmux-spawn-3fc3de1b-6e2d-43bf-ad3d-bf55b4ce3a1a.scope
12         Slice: user-1000.slice
13     Owner UID: 1000 (klm)
14       Boot ID: 8b9d5dcffc3a4669b0c7fa244db334be
15    Machine ID: 814e9c58b1e34999a682767020267eb0
16      Hostname: chieftec
17       Storage: /var/lib/systemd/coredump/core.h2o.33.8b9d5dcffc3a4669b0c7fa244db334be.16354.1712772132000000.zst (inaccessible)
18       Message: Process 16354 (h2o) of user 33 dumped core.
19
20                Stack trace of thread 16363:
21                #0  0x0000777802fe7bb3 n/a (libcrypto.so.53 + 0xd0bb3)
22                #1  0x00007778030efd5b SSL_CTX_flush_sessions (libssl.so.56 + 0x24d5b)
23                #2  0x00005d994cc02023 cache_cleanup_thread (h2o + 0x12a023)
24                #3  0x0000777802c7755a n/a (libc.so.6 + 0x8b55a)
25                #4  0x0000777802cf4a3c n/a (libc.so.6 + 0x108a3c)

The command coredumpctl list enlists the core's so far:

1$ coredumpctl list
2TIME                           PID UID GID SIG     COREFILE     EXE          SIZE
3Sat 2024-04-06 17:55:20 CEST 24746  33  33 SIGSEGV inaccessible /usr/bin/h2o    -
4Sat 2024-04-06 18:49:20 CEST 26982  33  33 SIGSEGV inaccessible /usr/bin/h2o    -
5Sat 2024-04-06 18:50:04 CEST 27178  33  33 SIGSEGV inaccessible /usr/bin/h2o    -

You can start debugging with coredumpctl debug. That will call gdb.

The location and name of the core file can be changed by tampering with

1$ cat /proc/sys/kernel/core_pattern
2|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h

More information is here: Core dump file is not generated, coredumpctl, systemd-coredump.