User Tools

Site Tools


This is an old revision of the document!


Details of core files related to systemd-coredump.

External pages:

File list

  • /usr/lib/
    • sysctl.d/
      • 50-coredump.conf
    • systemd/
      • systemd-coredump
      • system/
        • systemd-coredump@.service
        • systemd-coredump.socket

Coredump configuration


kernel.core_pattern=|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e


|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e

Configuring the core dump

core dump variables

%%  a single % character
%c  core file size soft resource limit of  crashing  process  (since  Linux 2.6.24)
%d  dump  mode—same  as  value  returned by prctl(2) PR_GET_DUMPABLE (since Linux 3.7)
%e  executable filename (without path prefix)
%E  pathname of executable, with  slashes  ('/')  replaced  by  exclamation marks ('!') (since Linux 3.0).
%g  (numeric) real GID of dumped process
%h  hostname (same as nodename returned by uname(2))
%i  TID of thread that triggered core dump, as seen in the PID namespace in which the thread resides (since Linux 3.18)
%I  TID of thread that triggered core dump, as  seen  in  the  initial  PID namespace (since Linux 3.18)
%p  PID  of  dumped  process,  as  seen  in  the PID namespace in which the process resides
%P  PID of dumped process, as seen in  the  initial  PID  namespace  (since Linux 3.12)
%s  number of signal causing dump
%t  time of dump, expressed as seconds since the Epoch, 1970-01-01 00:00:00 +0000 (UTC)
%u  (numeric) real UID of dumped process

Piping to a program

  • The program must be specified using an absolute pathname (or a pathname relative to the root directory, /), and must immediately follow the '|' character.
  • The command-line arguments can include any of the % specifiers listed above. For example, to pass the PID of the process that is being dumped, specify %p in an argument.
  • The process created to run the program runs as user and group root.
  • Running as root does not confer any exceptional security bypasses. Namely, LSMs (e.g., SELinux) are still active and may prevent the handler from accessing details about the crashed process via /proc/[pid].
  • The program pathname is interpreted with respect to the initial mount namespace as it is always executed there. It is not affected by the settings (e.g., root directory, mount namespace, current working directory) of the crashing process.
  • The process runs in the initial namespaces (PID, mount, user, and so on) and not in the namespaces of the crashing process. One can utilize specifiers such as %P to find the right /proc/[pid] directory and probe/enter the crashing process's namespaces if needed.
  • The process starts with its current working directory as the root directory. If desired, it is possible change to the working directory of the dumping process by employing the value provided by the %P specifier to change to the location of the dumping process via /proc/[pid]/cwd.
  • Command-line arguments can be supplied to the program (since Linux 2.6.24), delimited by white space (up to a total line length of 128 bytes).
  • The RLIMIT_CORE limit is not enforced for core dumps that are piped to a program via this mechanism.
systemd-coredump.1542368289.txt.gz · Last modified: 2018/11/16 11:38 by rpjday