Core dumps of "rpm" command are being generated under / directory

Solution Unverified - Updated -

Issue

  • Core dumps of rpm --dbpath commands are being generated under / directory regularly
# file core.22598
core.22598: ELF 64-bit LSB core file, x86-64, version 1 (SYSV), SVR4-style, from '/usr/bin/rpm --dbpath /var/lib/rpm --queryformat %{NAME}|CSTOK|%{EPOCH}|CSTOK|%', real uid: 0, effective uid: 0, real gid: 0, effective gid: 0, execfn: '/usr/bin/rpm', platform: 'x86_64'
  • Stopping the falcon-sensor.service unit stops generating these core dumps

Environment

  • Red Hat Enterprise Linux 7
    • falcon-sensor.service (from 3rd party vendor CrowdStrike)
    • liboneagent (from 3rd party vendor Dynatrace)

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content