Linux-Apache-CoreDump

From DevRandom

Configure a RHEL system for Apache core dumps

1. Within the main Apache configuration file /etc/httpd/conf/httpd.conf add line at bottom of file:

CoreDumpDirectory /var/apache-dump

2. Create a new /var/apache-dump directory and correctly set ownership and permissions on directory:

mkdir /var/apache-dump
chown apache.apache /var/apache-dump     

3. Edit the file /etc/security/limits.conf and add line:

*               -       core    unlimited

4. Edit the file /etc/profile and change line :

ulimit -S -c 0 > /dev/null 2>1

to:

ulimit -S -c unlimited > /dev/null 2>1

5. Enable writing the PID to the core file after reboots. Edit the /etc/sysctl.conf file and add :

kernel.core_uses_pid = 1

If you want setuid programs to dump core (this can be a security issue) use

kernel.core_setuid_ok = 1    

To make change take effect now you can also

echo 1 > /proc/sys/kernel/core_uses_pid
echo 1 > /proc/sys/kernel/core_setuid_ok

6. Check /proc/sys/kernel/core_pattern

cat /proc/sys/kernel/core_pattern

If this is set to a path like /root/core, then that directory needs permissions for the process dumping core files Alternatively you can set this to just the word 'core'. This will create core files in the working directory for that process. Or you can set a full path like /var/cordumps/core

# cat /proc/sys/kernel/core_pattern 
core

7. Reboot or restart apache

service httpd restart

8. To test, use ps aux to list any Apache process and then kill -11 <PID> - then check the /var/apache-dump/ directory for new core file.

9. To analyse the dump file use

gdb httpd <core file>

10. You can look at a backtrace using the following

gdb> bt full