Bug 1333068

Summary: Limit corefile dump to the value set as MaxCrashReportsSize
Product: Red Hat Enterprise Linux 6 Reporter: Deepu K S <dkochuka>
Component: abrtAssignee: Matej Habrnal <mhabrnal>
Status: CLOSED ERRATA QA Contact: Martin Kyral <mkyral>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 6.7CC: abrt-devel-list, dkochuka, jberan, klaas, mhabrnal, mkyral
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: abrt-2.0.8-41.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-03-21 11:39:40 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1269194    
Attachments:
Description Flags
Patch 1/1: ccpp: fast dumping and abrt core limit none

Description Deepu K S 2016-05-04 15:14:33 UTC 
Description of problem:
Limit the corefiles dumped in /var/spool/abrt to strictly 1GiB if we have "MaxCrashReportsSize = 1000" in `/etc/abrt/abrt.conf`.

Now, if we have a highly memory consuming application; it is likely to dump core to sometimes >10GiB which can fill up the /var filesystem.


Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux 6
abrt-2.0.8-34.el6.x86_64


How reproducible:
Always


Steps to Reproduce:
1. Kill a high memory consuming application, and capture coredump in /var/spool/abrt
2.
3.

Actual results:
Feb  8 17:26:52 scrbmrsdk000952 abrt[41162]: Saved core dump of pid 38022 (/home/test2/testapp) to /var/spool/abrt/ccpp-2016-02-08-17:26:45-38022 (4220542976 bytes)
Feb  8 17:26:52 scrbmrsdk000952 abrtd: Directory 'ccpp-2016-02-08-17:26:45-38022' creation detected
Feb  8 17:26:54 scrbmrsdk000952 abrt[41162]: /var/spool/abrt is 8445954791 bytes (more than 1279MiB), deleting 'ccpp-2016-02-08-17:11:14-36941'
Feb  8 17:26:56 scrbmrsdk000952 abrtd: '/var/spool/abrt/ccpp-2015-10-15-07:02:21-23191' is not a problem directory
Feb  8 17:26:56 scrbmrsdk000952 abrtd: '/var/spool/abrt/ccpp-2015-10-15-07:42:45-29774' is not a problem directory
Feb  8 17:26:57 scrbmrsdk000952 abrtd: '/var/spool/abrt/ccpp-2015-10-15-08:41:54-34553' is not a problem directory
Feb  8 17:26:57 scrbmrsdk000952 abrtd: '/var/spool/abrt/ccpp-2015-10-15-12:53:18-33797' is not a problem directory

Feb  8 19:06:52 scrbmrsdk000952 abrtd: Sending an email...
Feb  8 19:06:52 scrbmrsdk000952 abrtd: Email was sent to: root@localhost
Feb  9 06:32:57 scrbmrsdk000952 abrt[21717]: Not saving repeating crash in '/home/test2/testapp1'
Feb  9 06:32:58 scrbmrsdk000952 abrt[21718]: Saved core dump of pid 60878 (/home/test2/testapp1) to /var/spool/abrt/ccpp-2016-02-09-06:32:57-60878 (161607680 bytes)
Feb  9 06:32:58 scrbmrsdk000952 abrt[21718]: /var/spool/abrt is 4386930785 bytes (more than 1279MiB), deleting 'ccpp-2016-02-08-19:03:12-50067'
Feb  9 06:32:58 scrbmrsdk000952 abrtd: Directory 'ccpp-2016-02-09-06:32:57-60878' creation detected


Expected results:
Limit corefile sizes captured to MaxCrashReportsSize value. The problem directory need not be deleted.
Log in /var/log/mesaages that corefile is truncated. User can then blacklist if needed as in Bug #1208713

Additional info:
Please update abrt man pages for plugin configuration files such as 'CCpp.conf'.
It would be helpful if we can add a manpage for abrt-hook-ccpp and its functions.
Comment 5 Matej Habrnal 2016-11-03 08:56:19 UTC 
Created attachment 1216894 [details]
Patch 1/1: ccpp: fast dumping and abrt core limit
Comment 7 Matej Habrnal 2016-11-03 11:59:47 UTC 
The following test case covers the bug:
https://github.com/abrt/abrt/commit/218ee2d3105a1be4c696a0d1297e0a9de2f07631
Comment 10 errata-xmlrpc 2017-03-21 11:39:40 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2017-0768.html
Comment 11 Klaas Demter 2018-03-14 08:43:26 UTC 
did this change make it into rhel7 aswell? I can't seem to find the option in 'man abrt-CCpp.conf'