abrt collect unpackaged process coredump.

Issue

• Customer's system became out of disk space by coredump.
• df -k

2014-06-03 17:03:20 Filesystem    Type 1024-blocks      Used Available Capacity Mounted on
2014-06-03 17:03:20 /dev/mapper/vg_system-lv_root ext4  89403600  17468740  67393420      21% /
2014-06-03 17:08:20 /dev/mapper/vg_system-lv_root ext4  89403600  17471608  67390552      21% /
2014-06-03 17:15:52 /dev/mapper/vg_system-lv_root ext4  89403600  70400164  14461996      83% /
2014-06-03 17:20:24 /dev/mapper/vg_system-lv_root ext4  89403600  89403600         0     100% /
                                                                            ^^^^^^^^
                                                                            * out of disk space
2014-06-03 17:25:24 /dev/mapper/vg_system-lv_root ext4  89403600  17473460  67388700      21% /

• lsof

2014-06-03 17:11:21 COMMAND     PID      USER   FD      TYPE             DEVICE    SIZE/OFF       NODE NAME
2014-06-03 17:11:21 abrt-hook  8200      root    3w      REG              253,0 49061658624    3417258 /var/spool/abrt/ccpp-2014-06-03-17:09:33-27401.new/coredump
                     ^^^^^^^^^^^^^^^^^^^^^^^^^
                       * date and PID

• top

2014-06-03 17:09:53   PID  PPID USER     TTY       PR  NI nFLT  VIRT  RES  SHR nDRT WCHAN     Flags    S %CPU %MEM TIME  P COMMAND
2014-06-03 17:09:53 27401 26793 root     ?         19  -1  52k  145g 134g  12m    0 exit_mm   ..4.25.4 D 165.5 71.1 104,35  4 [PrimProc]
2014-06-03 17:09:53  8200    64 root     ?         20   0    4 13340  976  848    0 -         8.4.a1.. R 32.3  0.0 0:19  0 /usr/libexec/abrt-hook-ccpp 11 0 27401 0 0 1401782973 e

• /var/log/messages

Jun  3 17:09:33 server kernel: PrimProc[8156] general protection ip:4b4980 sp:7faa3bbe88f0 error:0 in PrimProc[400000+ee000]
Jun  3 17:12:33 server kernel: INFO: task PrimProc:27401 blocked for more than 120 seconds.
Jun  3 17:12:33 server kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  :
Jun  3 17:16:51 server abrt[8200]: Write error: No space left on device
Jun  3 17:21:08 server ServerMonitor[27217]: 08.113865 |0|0|0| I 09 CAL00
Jun  3 17:22:19 server abrt[8200]: Error writing '/var/spool/abrt/ccpp-2014-06-03-17:09:33-27401.new/coredump'

• /etc/abrt/abrt-action-save-package-data.conf

ProcessUnpackaged = no

• But 3rd party process is not installed by rpm (extract tar.gz).

• So, I guess that abrt operate by following flow. Is this flow correct?

  • collect coredump. (then, customer's system is out of disk space)
  • check packaged process or not.
  • if process is unpackaged, delete coredump.

• If above question's answer is yes, Is there how to stop abrt operation before coredump collection except stop abrtd. ex.

  • check packaged process or not.
  • if process is packaged, collect coredump.