Parameter kernel.core_pattern is overwritten at boot time in Red Hat Enterprise Linux 6

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux (RHEL) 6
  • abrt
  • abrt-addon-ccpp

Issue

  • The kernel parameter kernel.core_pattern is overwritten at reboot to the following configuration:

    # sysctl kernel.core_pattern  
kernel.core_pattern = |/usr/libexec/abrt-hook-ccpp /var/spool/abrt %s %c %p %u %g %t %h %e 636f726500

  • This occurs even when a value is manually specified in /etc/sysctl.conf. The value can be manually reset using the sysctl -p command confirming that the syntax of /etc/sysctl.conf is correct. But the value is still reset on every reboot.

Resolution

When abrtd service starts, kernel.core_pattern is overwritten automatically by the system installed abrt-addon-ccpp.

Two ways are available to resolve this:

  • Setting DumpLocation option in the /etc/abrt/abrt.conf configuration file.

    The destination directory can be specified by setting DumpLocation = /some/dir in the /etc/abrt/abrt.conf configuration file.
    And sysctl kernel.core_pattern's displayed value will be the same but the actual core file will be created to the directory under /some/dir.

    If the system uses selinux,please run below command for set selinux context:

    # semanage fcontext -a -t public_content_rw_t "/some/dir(/.*)?"
# setsebool -P abrt_anon_write 1
# service abrtd restart

  • Stop abrtd service. kernel.core_pattern will not be overwritten.

Root Cause

  • This behavior is the result of the Automatic Bug Reporting Tool (ABRT).

  • If the ABRT daemon is running, it will dynamically overwrite the destination of core files to /var/spool/abrt/.

  • If the coredump handler abrt-addon-ccpp plugin is installed, the core pattern value will appear as:

kernel.core_pattern = |/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments