When configuring the system to use abrt-ccpp instead of systemd-coredump, if running "sysctl --system", it will override kernel.core_pattern To reproduce the issue, assuming it is using systemd-coredump, what should be default, run: # systemctl disable abrt-journal-core.service # systemctl mask abrt-journal-core.service # systemctl stop abrt-journal-core.service # systemctl enable abrt-ccpp.service # systemctl start abrt-ccpp.service After above steps, might need to run: # systemctl daemon-reload or reboot. After that /proc/sys/kernel/core_pattern should show it is using abrt-hook-ccpp. The problem is that if running "sysctl --system" will change back to use systemd-coredump, leaving the system in a confusing state. It should be possible to use abrt-ccpp instead of systemd-coredump and also be able to run "sysctl --system", without any hacking around to save/restore /proc/sys/kernel/core_pattern
I think it should be ABRT package that will ship/create sysctl snippet that would override the default one.
To expand comment 1 a bit: the way abrt sets up kernel.core_pattern is just incompatible with `sysctl --system`. abrt-ccpp.service changes the core_pattern on the fly, on start/stop of the service, but sysctl configuration *on disk* remains unchanged. Hence, when `sysctl --system` is run, it just reapplies that configuration, overriding the value previously written by abrt-ccpp.service. There are two simple ways to fix this: 1/ Ship a config. file for sysctl that overrides the kernel.core_pattern set by systemd's config. file (which is /usr/lib/sysctl.d/50-coredump.conf, so something like /usr/lib/sysctl.d/60-abrt.conf would do.) Then kernel.core pattern would be set to abrt just by installing abrt (or a subpackage of abrt that contains the C++ hook). 2/ Also write the core_pattern to a temporary config. file in /run/sysctl.d on start of abrt-ccpp.service (and remove the file again on stop).