man/systemd-coredump.xml

   1 <?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   SPDX-License-Identifier: LGPL-2.1+
   7
   8   Copyright © 2014 Zbigniew Jędrzejewski-Szmek
   9 -->
  10
  11 <refentry id="systemd-coredump" conditional='ENABLE_COREDUMP'
  12           xmlns:xi="http://www.w3.org/2001/XInclude">
  13
  14   <refentryinfo>
  15     <title>systemd-coredump</title>
  16     <productname>systemd</productname>
  17   </refentryinfo>
  18
  19   <refmeta>
  20     <refentrytitle>systemd-coredump</refentrytitle>
  21     <manvolnum>8</manvolnum>
  22   </refmeta>
  23
  24   <refnamediv>
  25     <refname>systemd-coredump</refname>
  26     <refname>systemd-coredump.socket</refname>
  27     <refname>systemd-coredump@.service</refname>
  28     <refpurpose>Acquire, save and process core dumps</refpurpose>
  29   </refnamediv>
  30
  31   <refsynopsisdiv>
  32     <para><filename>/usr/lib/systemd/systemd-coredump</filename></para>
  33     <para><filename>/usr/lib/systemd/systemd-coredump</filename> <option>--backtrace</option></para>
  34     <para><filename>systemd-coredump@.service</filename></para>
  35     <para><filename>systemd-coredump.socket</filename></para>
  36   </refsynopsisdiv>
  37
  38   <refsect1>
  39     <title>Description</title>
  40     <para><filename>systemd-coredump@.service</filename> is a system service that can acquire core
  41     dumps from the kernel and handle them in various ways. The <command>systemd-coredump</command>
  42     executable does the actual work. It is invoked twice: once as the handler by the kernel, and the
  43     second time in the <filename>systemd-coredump@.service</filename> to actually write the data to
  44     the journal.</para>
  45
  46     <para>When the kernel invokes <command>systemd-coredump</command> to handle a core dump, it runs
  47     in privileged mode, and will connect to the socket created by the
  48     <filename>systemd-coredump.socket</filename> unit, which in turn will spawn an unprivileged
  49     <filename>systemd-coredump@.service</filename> instance to process the core dump. Hence
  50     <filename>systemd-coredump.socket</filename> and <filename>systemd-coredump@.service</filename>
  51     are helper units which do the actual processing of core dumps and are subject to normal service
  52     management.</para>
  53
  54     <para>Core dumps can be written to the journal or saved as a file. Once saved they can be retrieved
  55     for further processing, for example in
  56     <citerefentry project='man-pages'><refentrytitle>gdb</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
  57     </para>
  58
  59     <para>By default, <command>systemd-coredump</command> will log the core dump including a backtrace
  60     if possible to the journal and store the core dump itself in an external file in
  61     <filename>/var/lib/systemd/coredump</filename>.</para>
  62
  63     <para>The behavior of a specific program upon reception of a signal is governed by a few
  64     factors which are described in detail in
  65     <citerefentry project='man-pages'><refentrytitle>core</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
  66     In particular, the core dump will only be processed when the related resource limits are sufficient.
  67     </para>
  68
  69     <para>It is also possible to invoke <command>systemd-coredump</command> with
  70     <option>--backtrace</option> option. In this case, <command>systemd-coredump</command> expects
  71     a journal entry in the journal
  72     <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
  73     on standard input. The entry should contain a <varname>MESSAGE=</varname> field and any additional
  74     metadata fields the caller deems reasonable. <command>systemd-coredump</command> will append
  75     additional metadata fields in the same way it does for core dumps received from the kernel. In
  76     this mode, no core dump is stored in the journal.</para>
  77   </refsect1>
  78
  79   <refsect1>
  80     <title>Configuration</title>
  81     <para>For programs started by <command>systemd</command> process resource limits can be set by directive
  82     <varname>LimitCore=</varname>, see
  83     <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
  84     </para>
  85
  86     <para>In order to be used by the kernel to handle core dumps,
  87     <command>systemd-coredump</command> must be configured in
  88     <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  89     parameter <varname>kernel.core_pattern</varname>. The syntax of this parameter is explained in
  90     <citerefentry project='man-pages'><refentrytitle>core</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
  91     systemd installs the file <filename>/usr/lib/sysctl.d/50-coredump.conf</filename> which configures
  92     <varname>kernel.core_pattern</varname> accordingly. This file may be masked or overridden to use a different
  93     setting following normal
  94     <citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  95     rules. If the sysctl configuration is modified, it must be updated in the kernel before it
  96     takes effect, see
  97     <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  98     and
  99     <citerefentry><refentrytitle>systemd-sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
 100     </para>
 101
 102     <para>In order to by used in the <option>--backtrace</option> mode, an appropriate backtrace
 103     handler must be installed on the sender side. For example, in case of
 104     <citerefentry project='die-net'><refentrytitle>python</refentrytitle><manvolnum>1</manvolnum></citerefentry>, this
 105     means a <varname>sys.excepthook</varname> must installed, see
 106     <ulink url="https://github.com/keszybz/systemd-coredump-python">systemd-coredump-python</ulink>.
 107     </para>
 108
 109     <para>The behavior of <command>systemd-coredump</command> itself is configured through the configuration file
 110     <filename>/etc/systemd/coredump.conf</filename> and corresponding snippets
 111     <filename>/etc/systemd/coredump.conf.d/*.conf</filename>, see
 112     <citerefentry><refentrytitle>coredump.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. A new
 113     instance of <command>systemd-coredump</command> is invoked upon receiving every core dump. Therefore, changes
 114     in these files will take effect the next time a core dump is received.</para>
 115
 116     <para>Resources used by core dump files are restricted in two ways. Parameters like maximum size of acquired
 117     core dumps and files can be set in files <filename>/etc/systemd/coredump.conf</filename> and snippets mentioned
 118     above. In addition the storage time of core dump files is restricted by <command>systemd-tmpfiles</command>,
 119     corresponding settings are by default in <filename>/usr/lib/tmpfiles.d/systemd.conf</filename>.</para>
 120
 121     <refsect2>
 122       <title>Disabling coredump processing</title>
 123
 124       <para>To disable potentially resource-intensive processing by <command>systemd-coredump</command>,
 125       set <programlisting>Storage=none
 126 ProcessSizeMax=0</programlisting> in
 127       <citerefentry><refentrytitle>coredump.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 128       </para>
 129     </refsect2>
 130   </refsect1>
 131
 132   <refsect1>
 133     <title>Usage</title>
 134     <para>Data stored in the journal can be viewed with
 135     <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 136     as usual.
 137     <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 138     can be used to retrieve saved core dumps independent of their location, to display information and to process
 139     them e.g. by passing to the GNU debugger (gdb).</para>
 140   </refsect1>
 141
 142   <refsect1>
 143     <title>See Also</title>
 144     <para>
 145       <citerefentry><refentrytitle>coredump.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 146       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 147       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 148       <citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 149       <citerefentry project='man-pages'><refentrytitle>core</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 150       <citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 151       <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
 152     </para>
 153   </refsect1>
 154 </refentry>