Linux – Where is core file with abrt-hook-cpp installed

abrtcore-dumplinux

I posted this question to StackOverflow a little while ago, but just now found this community, and felt like this is at least an equally appropriate site for this question:

I've been led to understand that if abrt-ccpp.service is installed on a Linux PC, it supersedes/overwrites (I've read both, not sure which is true) the file /proc/sys/kernel/core_pattern, which otherwise specifies the location and filename pattern of core files.

Question:

When I execute systemctl, why does abrt-ccpp.service report exited under the SUB column? I don't understand the combination of active and exited: is the service "alive"/active/running or not?

> systemctl
UNIT                 LOAD   ACTIVE SUB
abrt-ccpp.service    loaded active exited ...

Question:

Where are core files generated? I wrote this program to generate a SIGSEGV:

#include <iostream>

int main(int argc, char* argv[], char* envz[])
{
  int* pInt = NULL;
  std::cout << *pInt << std::endl;
  return 0;
}

Compilation and execution as follows:

> g++ main.cpp
> ./a.out
Segmentation fault (core dumped)

But I cannot locate where the core file is generated.

What I have tried:

  • Looked in the same directory as my main.cpp. Core file is not there.
  • Looked in /var/tmp/abrt/ because of the following comment in /etc/abrt/abrt.conf. Core file is not there.

# Specify where you want to store coredumps and all files which are needed for
# reporting. (default:/var/tmp/abrt)
#
# Changing dump location could cause problems with SELinux. See man_abrt_selinux(8).
#
#DumpLocation = /var/tmp/abrt

  • Looked in /var/spool/abrt/ because of a comment at this link. Core file is not there.
  • Edited /etc/abrt/abrt.conf and uncommented and set DumpLocation = ~/foo which is an existing directory. Followed this by restarting abrt-hook-ccpp (sudo service abrt-ccpp restart) and rerunning a.out. Core file was not generated in ~/foo/
  • Verified that ulimit -c reports unlimited.

I am out of ideas of what else to try and where else to look.

In case helpful, this is the content of my /proc/sys/kernel/core_pattern:

> cat /proc/sys/kernel/core_pattern
|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e

Can someone help explain how the abrt-hook-ccpp service works and where it generates core files? Thank you.

Best Answer

One possibility is the need to change the line in the config file /etc/abrt/abrt-action-save-package-data.conf

ProcessUnpackaged = no

to yes, otherwise abrtd will only capture corefiles from programs installed by the package manager (dnf, apt, or whatever). Use abrt-gui or abrt-cli to look for core dumps.

Related Question