man/systemd-coredump.xml

   1 <?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   SPDX-License-Identifier: LGPL-2.1+
   7
   8   This file is part of systemd.
   9
  10   Copyright 2014 Zbigniew Jędrzejewski-Szmek
  11 -->
  12
  13 <refentry id="systemd-coredump" conditional='ENABLE_COREDUMP'
  14           xmlns:xi="http://www.w3.org/2001/XInclude">
  15
  16   <refentryinfo>
  17     <title>systemd-coredump</title>
  18     <productname>systemd</productname>
  19
  20     <authorgroup>
  21       <author>
  22         <contrib>Developer</contrib>
  23         <firstname>Lennart</firstname>
  24         <surname>Poettering</surname>
  25         <email>lennart@poettering.net</email>
  26       </author>
  27     </authorgroup>
  28   </refentryinfo>
  29
  30   <refmeta>
  31     <refentrytitle>systemd-coredump</refentrytitle>
  32     <manvolnum>8</manvolnum>
  33   </refmeta>
  34
  35   <refnamediv>
  36     <refname>systemd-coredump</refname>
  37     <refname>systemd-coredump.socket</refname>
  38     <refname>systemd-coredump@.service</refname>
  39     <refpurpose>Acquire, save and process core dumps</refpurpose>
  40   </refnamediv>
  41
  42   <refsynopsisdiv>
  43     <para><filename>/usr/lib/systemd/systemd-coredump</filename></para>
  44     <para><filename>/usr/lib/systemd/systemd-coredump</filename> <option>--backtrace</option></para>
  45     <para><filename>systemd-coredump@.service</filename></para>
  46     <para><filename>systemd-coredump.socket</filename></para>
  47   </refsynopsisdiv>
  48
  49   <refsect1>
  50     <title>Description</title>
  51     <para><filename>systemd-coredump@.service</filename> is a system service that can acquire core
  52     dumps from the kernel and handle them in various ways. The <command>systemd-coredump</command>
  53     executable does the actual work. It is invoked twice: once as the handler by the kernel, and the
  54     second time in the <filename>systemd-coredump@.service</filename> to actually write the data to
  55     the journal.</para>
  56
  57     <para>When the kernel invokes <command>systemd-coredump</command> to handle a core dump, it runs
  58     in privileged mode, and will connect to the socket created by the
  59     <filename>systemd-coredump.socket</filename> unit, which in turn will spawn an unprivileged
  60     <filename>systemd-coredump@.service</filename> instance to process the core dump. Hence
  61     <filename>systemd-coredump.socket</filename> and <filename>systemd-coredump@.service</filename>
  62     are helper units which do the actual processing of core dumps and are subject to normal service
  63     management.</para>
  64
  65     <para>Core dumps can be written to the journal or saved as a file. Once saved they can be retrieved
  66     for further processing, for example in
  67     <citerefentry project='man-pages'><refentrytitle>gdb</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
  68     </para>
  69
  70     <para>By default, <command>systemd-coredump</command> will log the core dump including a backtrace
  71     if possible to the journal and store the core dump itself in an external file in
  72     <filename>/var/lib/systemd/coredump</filename>.</para>
  73
  74     <para>The behavior of a specific program upon reception of a signal is governed by a few
  75     factors which are described in detail in
  76     <citerefentry project='man-pages'><refentrytitle>core</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
  77     In particular, the core dump will only be processed when the related resource limits are sufficient.
  78     </para>
  79
  80     <para>It is also possible to invoke <command>systemd-coredump</command> with
  81     <option>--backtrace</option> option. In this case, <command>systemd-coredump</command> expects
  82     a journal entry in the journal
  83     <ulink url="https://www.freedesktop.org/wiki/Software/systemd/export">Journal Export Format</ulink>
  84     on standard input. The entry should contain a <varname>MESSAGE=</varname> field and any additional
  85     metadata fields the caller deems reasonable. <command>systemd-coredump</command> will append
  86     additional metadata fields in the same way it does for core dumps received from the kernel. In
  87     this mode, no core dump is stored in the journal.</para>
  88   </refsect1>
  89
  90   <refsect1>
  91     <title>Configuration</title>
  92     <para>For programs started by <command>systemd</command> process resource limits can be set by directive
  93     <varname>LimitCore=</varname>, see
  94     <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
  95     </para>
  96
  97     <para>In order to be used by the kernel to handle core dumps,
  98     <command>systemd-coredump</command> must be configured in
  99     <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 100     parameter <varname>kernel.core_pattern</varname>. The syntax of this parameter is explained in
 101     <citerefentry project='man-pages'><refentrytitle>core</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 102     systemd installs the file <filename>/usr/lib/sysctl.d/50-coredump.conf</filename> which configures
 103     <varname>kernel.core_pattern</varname> accordingly. This file may be masked or overridden to use a different
 104     setting following normal
 105     <citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 106     rules. If the sysctl configuration is modified, it must be updated in the kernel before it
 107     takes effect, see
 108     <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 109     and
 110     <citerefentry><refentrytitle>systemd-sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
 111     </para>
 112
 113     <para>In order to by used in the <option>--backtrace</option> mode, an appropriate backtrace
 114     handler must be installed on the sender side. For example, in case of
 115     <citerefentry project='die-net'><refentrytitle>python</refentrytitle><manvolnum>1</manvolnum></citerefentry>, this
 116     means a <varname>sys.excepthook</varname> must installed, see
 117     <ulink url="https://github.com/keszybz/systemd-coredump-python">systemd-coredump-python</ulink>.
 118     </para>
 119
 120     <para>The behavior of <command>systemd-coredump</command> itself is configured through the configuration file
 121     <filename>/etc/systemd/coredump.conf</filename> and corresponding snippets
 122     <filename>/etc/systemd/coredump.conf.d/*.conf</filename>, see
 123     <citerefentry><refentrytitle>coredump.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>. A new
 124     instance of <command>systemd-coredump</command> is invoked upon receiving every core dump. Therefore, changes
 125     in these files will take effect the next time a core dump is received.</para>
 126
 127     <para>Resources used by core dump files are restricted in two ways. Parameters like maximum size of acquired
 128     core dumps and files can be set in files <filename>/etc/systemd/coredump.conf</filename> and snippets mentioned
 129     above. In addition the storage time of core dump files is restricted by <command>systemd-tmpfiles</command>,
 130     corresponding settings are by default in <filename>/usr/lib/tmpfiles.d/systemd.conf</filename>.</para>
 131   </refsect1>
 132
 133   <refsect1>
 134     <title>Usage</title>
 135     <para>Data stored in the journal can be viewed with
 136     <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 137     as usual.
 138     <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 139     can be used to retrieve saved core dumps independent of their location, to display information and to process
 140     them e.g. by passing to the GNU debugger (gdb).</para>
 141   </refsect1>
 142
 143   <refsect1>
 144     <title>See Also</title>
 145     <para>
 146       <citerefentry><refentrytitle>coredump.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 147       <citerefentry><refentrytitle>coredumpctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 148       <citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 149       <citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 150       <citerefentry project='man-pages'><refentrytitle>core</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 151       <citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 152       <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
 153     </para>
 154   </refsect1>
 155 </refentry>