How to collect core dump file of a crashing program that is shipped in Red Hat Enterprise Linux

Solution Verified - Updated -


  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • abrt


  • How to collect core dump file of a program on RHEL6 and above
  • How to report an application crash in RHEL6 and above
  • How to configure abrt to automatically generate an application core
  • How do I collect process core file in a container?


  • Red Hat Enterprise Linux 6/7/8 has a service called abrt, which automatically collects the core dump files on the server and stores them inside the /var/spool/abrt.

  • ABRT is not present in RHEL 9, The Coredumps can be captured through systemd coredumpctl functionality.

  1. Ensure that the system is set up to generate application cores by removing the core limits:

    1. For the current interactive shell.

      Check the current core ulimit.

      # ulimit -c

      Set the core ulimit to unlimited.

      # ulimit -c unlimited
    2. For a given user.

      Login as the user and check the current core ulimit as above.

      Edit /etc/security/limits.conf; see 'How to set ulimit values' for details.

    3. For a RHEL 6 service.

      Check the current core ulimit. Replace PID with the PID of your service.

      # cat /proc/31220/limits
      Limit                     Soft Limit           Hard Limit           Units     
      Max core file size        0                    unlimited            bytes     

      Add the desired ulimit command(s) to /etc/sysconfig/SERVICENAME; see 'How to set limits (ulimit) for services in RHEL6 and older with upstart, sysvinit' for details.

    4. For a RHEL 7+ service.

      Check the current core ulimit.

      # systemctl show rsyslog | grep LimitCORE

      Set the core ulimit to unlimited. Override the current ulimit by running,

      # systemctl edit SERVICENAME

      In the editor, add 'LimitCORE=infinity', example below.


      See 'How to set limits for services in RHEL and systemd' for more details.

  2. Make sure abrt and abrt-addon-ccpp is installed

    # yum install abrt abrt-addon-ccpp abrt-tui
  3. Ensure the ccpp hooks are installed:

    # abrt-install-ccpp-hook install
    # abrt-install-ccpp-hook is-installed; echo $?;

    The second command should return 0 (hooks installed)

  4. Ensure that this service is up and the ccpp hook to capture core dumps is enabled:

    for RHEL6

    # service abrtd start
    # service abrt-ccpp start

    for RHEL6, configure services to start on boot. Optional

    # chkconfig abrtd on
    # chkconfig abrt-ccpp on

    for RHEL 7 or RHEL 8

    # systemctl start abrtd.service
    # systemctl start abrt-ccpp.service 

    For RHEL 7 or RHEL 8, configure services to start on boot. Optional

    # systemctl enable abrtd.service
    # systemctl enable abrt-ccpp.service
  • To look for core dumps using the GUI, run the command:

    for RHEL6

    # abrt-gui

    for RHEL7 or RHEL 8

    # gnome-abrt
  • To get a list of crashes on the command line, issue the following command:

    # abrt-cli list
  • To generate a report of a specific crash:

    # abrt-cli report DUMPDIR
  • Choose the RHTSupport option to reports crashes into the Red Hat Technical Support system. Alternatively, you may use the abrt-cli command to get detailed information about particular crash:

    # abrt-cli info DUMPDIR
  • Locate the coredump file path, and provide the entire directory to the Red Hat Support representative.

    Show information on the DUMPDIR.

    # abrt-cli info DUMPDIR
    id 68fb7093b18414f689d9c7bea9b12f55ea6822ba
    reason:         rsyslogd killed by SIGBUS
    Directory:      /var/spool/abrt/ccpp-2023-08-09-19:25:03-22545

    Copy the DUMPDIR

    # tar -cJf ~/rsyslog-crash-`hostname -s`.tar.xz /var/spool/abrt/ccpp-2023-08-09-19:25:03-22545

For more details refer to the following documents.

Note for RHEL-6.1 and earlier:

The command invocations:

# abrt-cli list
# abrt-cli report
# abrt-cli info


# abrt-cli --list
# abrt-cli --report
# abrt-cli --info

In RHEL versions 6.1 and earlier. Additionally, in RHEL-6.1 and earlier, abrt refers to crashes by their UUID (obtained from the output of abrt-cli --list) rather than the dump directory.

Enable dumping for unsigned packages

  • To collect core dumps from unsigned packages, (such as third party or in-house developed applications), do the following:
    1. Edit /etc/abrt/abrt-action-save-package-data.conf
    2. Change OpenGPGCheck = yes to OpenGPGCheck = no
    3. Save changes

Enable core dumps for unpackaged software

  • To collect core dumps from unpackaged software (such as in-house developed applications), do the following:
    1. Edit /etc/abrt/abrt-action-save-package-data.conf
    2. Change ProcessUnpackaged = no to ProcessUnpackaged = yes
    3. Save changes

Diagnostic Steps

RHEL8 container

Run sleep command.
    bash-4.4$ sleep 600 &
    [1] 6
Check pid of sleep process.
    bash-4.4$ ps aux | grep sleep
    default       6  0.0  0.1  23044  1396 pts/0    S    06:06   0:00 /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 600
    default       8  0.0  0.0   9204  1152 pts/0    S+   06:07   0:00 grep sleep
Send SIGABRT signal to sleep process.
    bash-4.4$ kill -SIGABRT 6
    [1]+  Aborted                 (core dumped) sleep 600
Exit the container.
    bash-4.4$ exit
 Run 'abrt-cli list'.
[root@podman83 ~]# abrt-cli list
id b633e788c46b56b1cae41db8bf4d17f49afbb315
reason:         coreutils killed by SIGABRT
time:           Mon May 31 15:11:05 2021
cmdline:        /usr/bin/coreutils --coreutils-prog-shebang=sleep /usr/bin/sleep 600
uid:            1001 ()
count:          1
Directory:      /var/spool/abrt/ccpp-2021-05-31-15:11:05-77032

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.


Also, ensure that abrtd and abrt-ccpp are permanently enabled

note that you do need to install the abrt and abrt-addon-ccpp packages

For RHEL 7 and systemd:
# ulimit -c unlimited
I doubt it will work at all, if you want to debug a daemon and the like, Ulimit only applies to child processes of a shell.
I have failed to enable core dumps on RHEL 7.1 following this solution.

Could you please correct that!

Thank you!

For RHEL 7, there seems to be one step missing, which is documented at the bottom of this page:

With abrt employed, you don't even need to touch ulimit at all and abrt will capture all core dump files - daemon, user process, etc.. However, there are various circumstances in which abrt does not catch a core dump file because the core dump file is not produced - there will be no core dump file even without abrt and using 'ulimit -c unlimited'. See 'man 5 core' for more details.

The most common case where a core dump file is not produced is when a process is executing a set-user-ID (set-group-ID) program. If you need to have a core dump file for such a process you need to set the /proc/sys/fs/suid_dumpable file to 2.


echo 2 > /proc/sys/fs/suid_dumpable


sysctl fs.suid_dumpable=2

Nice work.

it was so helpful. Now we configured on our environment.And how to read core dump file? using gdb or crash utility

Use gdb. First of all you need to have debuginfo available. If you open a core dump file in gdb, it should show you a command which you can use to install the missing debuginfo packages.

If you want to just see the backtrace without the need to delve into gdb details, you can use abrt to get the backtrace from the core dump file. Go to the relevant '/var/spool/abrt/ccpp-' directory and run abrt-action-analyze-ccpp-local which should donwload all required debuginfo data and create a new file named *backtrace containing the backtrace produced by gdb.

Thanks for your update.

On RHEL7 you need to install abrt-cli:

yum install abrt-cli -y

i have done configuration as per links, but logs are not getting generate.

rhel 6.5

Please modify the line, yum install abrt abrt-addon-ccpp abrt-tui to yum install abrt abrt-addon-ccpp abrt-gui

Warning: Even though it says it applies to RHEL 8 given the current state of this document as of 09-NOV-2020 you should use this document with caution if at all for RHEL8. By default an enabled abrt-ccpp will NOT start at boot on RHEL 8. There is some sort of bug out there but not clear what the resolution is. However, based on this Fedora article maybe we should not be using abrt-ccpp at all. The Red Hat documentation seems lacking for RHEL 8 in trying to resolve this issue and determine best practice.

Between what is discussed in the Bug and the above Fedora link seems like we should not be using abrt-ccpp with RHEL 8.

The solution should be enhanced with information for RHEL9 (abrt replaced by systemd-coredump).

Have you got a timeline, when the update occurs? -- I actually don't know how to send a good bug report to Red Hat - so I only have developer account for now, and is it even possible? (was abrt simpler to understand or it's just illusion when not paying for subscription?)