Consider switching to systemd-coredump for default kernel core dumps

Prasanna V. Loganathar pvl at prasannavl.com
Fri Feb 1 22:04:22 UTC 2019


Hi folks,

Currently, `$ sysctl kernel.core_pattern` gives
`kernel.core_pattern = |/usr/share/apport/apport %p %s %c %d %P`

This is usually fine, however, when run from containers or lxc this
will just error out, with no core dump being produced, due to it being
disabled. Adding to the problem: with container or lxc, you can't just
change it per container, and should be changed on the host. And it's
not reasonable to expect apport in all containers either. Since, this
is a common problem, I think it's important to consider a change in
the default handling.

There are multiple options to deal with this:

1. Drop apport as default core_pattern handler and switch to a simple
file in either /var/crash (this requires creating /var/crash as a part
of the installation as it's currently created by apport), or /tmp and
let apport handle the core dump after the fact, and report it.

2. Switch to systemd-coredump, and default to it, since it already
does this very well and provides "coredumpctl" which is much nicer to
work with. systemd-coredump also is a part of the systemd suite of
utils and doesn't pull in a larger dependency as apport -- which to
date, isn't as robust (I still have "core" files being left all over
the place due to the fact that apport reset's itself and crashes
during startup aren't handled properly). This also has a nice
advantage of unifying the OSS community in terms of coredump handler.
apport can handle things from the core dumps that systemd generates,
further on desktops.

3. Employ a tiny helper script, as the default core dump handler,
which looks for specified programs such as "apport", "abrt",
systemd-coredump" and pipes to them, or pipes it to /var/crash, or
/tmp during it's absence. This does have the disadvantage of growing
with it's own config, rather quickly.

That being said, I highly suggest option 2 be used in the upcoming
versions, and apport be a layer sitting on top of the coredumps
generated by systemd-coredumps by either hooking into it, or by
watching it's folders.

I've also filed this as a bug here:
https://bugs.launchpad.net/ubuntu/+bug/1813403




More information about the Ubuntu-devel-discuss mailing list