How to stop abrt from generating /detecting crash report for selected executables?

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • abrt

Issue

  • Repetitive crashes of an executable is shown in /var/log/messages. How to ignore these ABRT messages?
/var/log/messages  :

Aug 29 12:04:40 hostname1 abrt[24468]: saved core dump of pid 24467 (/usr/libexec/fprintd) to /var/spool/abrt/ccpp-1314587080-24467.new/coredump (6684672 bytes)  
Aug 29 12:04:40 hostname1 abrtd: Directory 'ccpp-1314587080-24467' creation detected  
Aug 29 12:04:40 hostname1 abrtd: Crash is in database already (dup of /var/spool/abrt/ccpp-1311570426-25876)  
Aug 29 12:04:40 hostname1 abrtd: Deleting crash ccpp-1314587080-24467 (dup of ccpp-1311570426-25876), sending dbus signal  
Aug 29 13:01:41 hostname1 abrt[25306]: saved core dump of pid 25305 (/usr/libexec/fprintd) to /var/spool/abrt/ccpp-1314590501-25305.new/coredump (6684672 bytes)  
Aug 29 13:01:41 hostname1 abrtd: Directory 'ccpp-1314590501-25305' creation detected  
Aug 29 13:01:41 hostname1 abrtd: Crash is in database already (dup of /var/spool/abrt/ccpp-1311570426-25876)  
Aug 29 13:01:41 hostname1 abrtd: Deleting crash ccpp-1314590501-25305 (dup of ccpp-1311570426-25876), sending dbus signal  
Aug 29 13:03:23 hostname1 abrt[25377]: saved core dump of pid 25376 (/usr/libexec/fprintd) to /var/spool/abrt/ccpp-1314590603-25376.new/coredump (6684672 bytes)  
Aug 29 13:03:23 hostname1 abrtd: Directory 'ccpp-1314590603-25376' creation detected  
Aug 29 13:03:23 hostname1 abrtd: Crash is in database already (dup of /var/spool/abrt/ccpp-1311570426-25876)  
Aug 29 13:03:23 hostname1 abrtd: Deleting crash ccpp-1314590603-25376 (dup of ccpp-1311570426-25876), sending dbus signal  
Aug 29 13:05:02 hostname1 abrt[25437]: saved core dump of pid 25436 (/usr/libexec/fprintd) to /var/spool/abrt/ccpp-1314590702-25436.new/coredump (6684672 bytes)  
Aug 29 13:05:02 hostname1 abrtd: Directory 'ccpp-1314590702-25436' creation detected  
Aug 29 13:05:02 hostname1 abrtd: Crash is in database already (dup of /var/spool/abrt/ccpp-1311570426-25876)  
Aug 29 13:05:02 hostname1 abrtd: Deleting crash ccpp-1314590702-25436 (dup of ccpp-1311570426-25876), sending dbus signal  
Aug 29 15:03:09 hostname1 abrt[27267]: saved core dump of pid 27266 (/usr/libexec/fprintd) to /var/spool/abrt/ccpp-1314597789-27266.new/coredump (6684672 bytes)  
Aug 29 15:03:09 hostname1 abrtd: Directory 'ccpp-1314597789-27266' creation detected  
Aug 29 15:03:09 hostname1 abrtd: Crash is in database already (dup of /var/spool/abrt/ccpp-1311570426-25876)  
Aug 29 15:03:09 hostname1 abrtd: Deleting crash ccpp-1314597789-27266 (dup of ccpp-1311570426-25876), sending dbus signal  
Aug 29 15:32:48 hostname1 init: serial (hvc0) main process ended, respawning  
Aug 29 15:32:51 hostname1 abrt[27676]: saved core dump of pid 27675 (/usr/libexec/fprintd) to /var/spool/abrt/ccpp-1314599571-27675.new/coredump (6684672 bytes)  
Aug 29 15:32:51 hostname1 abrtd: Directory 'ccpp-1314599571-27675' creation detected  
Aug 29 15:32:51 hostname1 abrtd: Crash is in database already (dup of /var/spool/abrt/ccpp-1311570426-25876)  
Aug 29 15:32:51 hostname1 abrtd: Deleting crash ccpp-1314599571-27675 (dup of ccpp-1311570426-25876), sending dbus signal  
Aug 29 16:08:37 hostname1 init: serial (hvc0) main process ended, respawning  
Aug 29 16:08:40 hostname1 abrt[29251]: saved core dump of pid 29250 (/usr/libexec/fprintd) to /var/spool/abrt/ccpp-1314601720-29250.new/coredump (6684672 bytes)  
Aug 29 16:08:40 hostname1 abrtd: Directory 'ccpp-1314601720-29250' creation detected  
Aug 29 16:08:40 hostname1 abrtd: New crash /var/spool/abrt/ccpp-1314601720-29250, processing
  • How to blacklist a package or executable such that ABRT doesn't process its crashes?
  • How to disable coredumping for selected executables inABRT?

Resolution

  • Include the package name about blacklist to /etc/abrt/abrt-action-save-package-data.conf.

    # With this option set to "yes",  
    # only crashes in signed packages will be analyzed.  
    # the list of public keys used to check the signature is  
    # in the file gpg_keys  
    #  
    OpenGPGCheck = yes
    
    # Blacklisted packages    
    #  
    BlackList = nspluginwrapper, valgrind, strace, mono-core, fprintd
    
  • If its an executable, include the absolute paths of the binary to BlackListedPaths under /etc/abrt/abrt-action-save-package-data.conf.

    BlackListedPaths = /path/of/executables
    
  • Abrt will ignore crashes in executables whose absolute path matches one of the specified patterns. Specific patterns of executables can also be added using '*'.

  • A new configuration option is included now; using 'IgnoredPaths' in /etc/abrt/plugins/CCpp.conf, ABRT can now exclude specific programs from generating a core dump.

    • Please see Root Cause section for the changes explained.
    • In /etc/abrt/plugins/CCpp.conf, add the absolute path of executable under IgnoredPaths option.
    IgnoredPaths = /usr/local/bin/testapp
    

    RHEL 6: be careful about trailing spaces in the BlackListedPaths and IgnoredPaths lines, since they are not ignored. For example, these lines will not work:

    BlackListedPaths = /path/of/executables,<space>
    BlackListedPaths = /path/of/executables<space>
    IgnoredPaths = /usr/local/bin/testapp<space>
    IgnoredPaths = /usr/local/bin/testapp<tab>
    

    These lines will work:

    BlackListedPaths = /path/of/executables<space>,
    IgnoredPaths = /usr/local/bin/testapp,
    IgnoredPaths = /usr/local/bin/testapp<space>,
    

    Trailing spaces are properly ignored on RHEL 7 and 8.

  • Restart the abrtd service.

    [RHEL 7,8] :
    # systemctl restart abrtd.service
    
    [RHEL 6] :
    # service abrtd restart
    

Root Cause

  • Previously, ignoring crashes of blacklisted programs in *abrt* using 'BlackListedPaths' option in /etc/abrt/abrt-action-save-package-data.conf did not prevent it from creating their core dumps, which were written to disk and then deleted. This approach allowed *abrt* to notify system administrators of a crash while not using disk space to store unneeded crash dumps. However, creating these dumps only to delete them later was unnecessarily wasting system resources.
    In case of memory intensive application crashes, the coredump fills up the disk which creates a risk when running under production.
    This update introduces a new configuration option IgnoredPaths in the /etc/abrt/plugins/CCpp.conf configuration file, which allows you to specify a comma-separated list of file system path patterns, for which core dump will not be generated at all.

    • System logs after adding the executable path under BlackListedPaths in /etc/abrt/abrt-action-save-package-data.conf
    May 23 07:49:37 example.com abrt-hook-ccpp[29764]: Process 29050 (testapp) of user 0 killed by SIGSEGV - dumping core
    May 23 07:49:38 example.com abrt-server[29778]: Blacklisted executable '/usr/local/bin/testapp'
    May 23 07:49:38 example.com abrt-server[29778]: 'post-create' on '/var/spool/abrt/ccpp-2019-05-23-07:49:37-29050' exited with 1
    May 23 07:49:38 example.com abrt-server[29778]: Deleting problem directory '/var/spool/abrt/ccpp-2019-05-23-07:49:37-29050'
    
    • System logs after adding the executable path under IgnoredPaths in /etc/abrt/plugins/CCpp.conf.
    May 23 07:52:06 example.com abrt-hook-ccpp[1732]: Process 1054 (testapp) of user 0 killed by SIGSEGV - ignoring (listed in 'IgnoredPaths')
    

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments