Issue

• For troubleshooting purposes, you want core dumps to be generated when a daemon (service) terminates abnormally.
• we need to know why segfault is happening

Environment

• Red Hat Enterprise Linux including
  • Red Hat Enterprise Linux 3
  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 5

Resolution

You need to make the following modifications in order to enable core dumps for daemons:

• Edit /etc/profile:

vi /etc/profile 

• Replace this line:

ulimit -S -c 0 > /dev/null 2>&1

with this line:

ulimit -c unlimited >/dev/null 2>&1

• Enable this globally by editing the /etc/sysconfig/init file and add this line:

DAEMON_COREFILE_LIMIT='unlimited'

• Note that changes to “ulimit” settings do not affect daemon processes which are already running, so you need to restart any daemons for which you want to enable core dumps. Alternatively, you can reboot the system to have the new settings take effect for all daemons.

• By default, core dumps are not generated by programs that are running setuid to prevent sensitive information being leaked. To enable core dumps for setuid programs (for the running kernel, not persistent over reboots):
  • For Red Hat Enterprise Linux 5: “suidsafe” (recommended) – protect privileged information by having the core dump be owned by and only readable for root:

echo 2 > /proc/sys/fs/suid_dumpable

• For Red Hat Enterprise Linux 5: “debug” (may cause privileged information to be leaked):

echo 1 > /proc/sys/fs/suid_dumpable

• For Red Hat Enterprise Linux 4:

echo 2 > /proc/sys/kernel/suid_dumpable

• For Red Hat Enterprise Linux 3:

echo 1 > /proc/sys/kernel/core_setuid_ok

• Changes to these /proc values take effect immediately (however these are not preserved upon reboot), so they will also apply to daemons that are already running.

• To enable core dumps for setuid programs (persistent over reboots):
  • Edit /etc/sysctl.conf and add the following:

fs.suid_dumpable = 2      # RHEL 5 only kernel.suid_dumpable = 2  # RHEL 4 only kernel.core_setuid_ok = 1 # RHEL 3 only kernel.core_pattern = /tmp/core

• Reload the settings in /etc/sysctl.conf:

sysctl -p

When the daemon terminates abnormally, a core file should appear in the configured location /tmp. The exact location and name of the core file can be controlled through the kernel.core_pattern sysctl which is documented in the core(5) manual page and /usr/share/doc/kernel-doc*/Documentation/sysctl/kernel.txt from the kernel-doc package.

Root Cause

• A daemon is a computer program that runs in the background, rather than under the direct control of a user; they are usually initiated as processes. Daemons are usually started with the service command or as an init script.

 

Source : https://access.redhat.com/kb/docs/DOC-5353