Solaris 7 System Administration Supplement

Improved Core File Management (`coreadm`)

This functionality is updated in the Solaris 7 8/99 software release.

Enhanced process core file features that include the coreadm command update the Solaris 7 software release. This information supplements information on troubleshooting software problems found in "Troubleshooting Software Problems (Overview)" in the System Administration Guide, Volume II.

This release introduces the coreadm command, which provides flexible core file naming conventions and better core file retention. For example, you can use the coreadm command to configure a system so that all process core files are placed in a single system directory. This means it is easier to track problems by examining the core files in a specific directory whenever a Solaris process or daemon terminates abnormally.

Limitations of the previous Solaris process core dump features are:

Process core files are placed in their current working directory, and thus all Solaris daemons, which typically chdir to the root (/) directory as part of their initialization, overwrite each other's core files.
Many system daemons, such as statd, perform setuid operations but do not, for security reasons, produce core files in the event of a problem.

Configurable Core File Paths

Two new configurable core file paths that can be enabled or disabled independently of each other are:

A per-process core file path, which defaults to core and is enabled by default. If enabled, the per-process core file path causes a core file to be produced when the process terminates abnormally. The per-process path is inherited by a new process from its parent process.

When generated, a per-process core file is owned by the owner of the process with read/write permissions for the owner. Only the owning user can view this file.
A global core file path is disabled by default. If enabled, an additional core file with the same content as the per-process core file is produced by using the global core file path.

When generated, a global core file is owned by the superuser with read/write permissions for the superuser only. Non-privileged users cannot view this file.

When a process terminates abnormally, it produces a core file in the current directory as in previous Solaris releases. But if the global core file path is enabled and set to /corefiles/core, for example, then each process that expires produces two core files: one in the current working directory and one in the /corefiles directory.

By default, the Solaris core paths and core file retention remain the same:

A setuid process does not produce core files using either the global or per-process path.
The global core file path is disabled.
The per-process core file path is enabled.
The per-process core file path is set to core.

Expanded Core File Names

If a global core file directory is enabled, core files can be distinguished from one another by using the variables described in the following table.

Variable Name	Variable Definition
`%p`	Process ID
`%u`	Effective user ID
`%g`	Effective group ID
`%f`	Executable file name
`%n`	System node name, equivalent to the `uname -n` output
`%m`	Machine name, equivalent to the `uname -m` output
`%t`	Decimal value of time(2) system call
`%%`	Literal %

For example, if the global core file path is set to:

/var/core/core.%f.%p

and a sendmail process with PID 12345 terminates abnormally, it produces the following core file:

/var/core/core.sendmail.12345

Setting the Core File Name Pattern

You can set a core file name pattern on a global basis or a per-process basis. You can specify whether you want these settings saved across a system reboot.

For example, the following coreadm command sets the global core file pattern for all processes started by the init process. This pattern will persist across system reboots.

$ coreadm -i /var/core/core.%f.%p

Global core values are stored in the /etc/coreadm.conf file, which means these settings are saved across a system reboot.

This coreadm command sets the per-process core file name pattern for all processes:

$ coreadm -p /var/core/core.%f.%p $$

The $$ symbols represent a placeholder for the process ID of the currently running shell. The per-process core file name pattern is inherited by all child processes.

Once a global or per-process core file name pattern is set, it must be enabled with the coreadm -e command. See the procedures below for more information.

You can set the core file name pattern for all processes run during a user's login session by putting the command in a user's $HOME/.profile or .login file.

Enabling `setuid` Programs to Produce Core Files

You can use the coreadm command to enable or disable setuid programs to produce core files for all system processes or on a per-process basis by setting the following paths:

If the global setuid option is enabled, a global core file path allows all setuid programs on a system to produce core files.
If the per-process setuid option is enabled, a per-process core file path allows specific setuid processes to produce core files.

By default, both flags are disabled. For security reasons, the global core file path must be a full pathname, starting with a leading /. If superuser disables per-process core files, individual users cannot obtain core files.

The setuid core files are owned by the superuser with read/write permissions for the superuser only. Ordinary users cannot access them even if the process that produced the setuid core file was owned by an ordinary user.

See coreadm(1M) for more information.

How to Display the Current Core Dump Configuration

Use the coreadm command without any options to display the current core dump configuration.

$ coreadm
               global core file pattern: /var/core/core.%f.%p
                 init core file pattern: core
                      global core dumps: enabled
                 per-process core dumps: enabled
                global setid core dumps: enabled
           per-process setid core dumps: disabled
               global core dump logging: disabled

How to Set a Core File Name Pattern

Determine whether you want to set a per-process or global core file and select one of the following:
1. Set a per-process core file name pattern.
  $ coreadm -p $HOME/corefiles/%f.%p $$
2. Set a global core file name pattern.
  
  Become superuser first.
  # coreadm -g /var/core/core.%f.%p

How to Display a Core File Name Pattern

Use the following coreadm command to inquire about the core file settings of the current process. The $$ symbols represent a placeholder for the process ID of the running shell.

$ coreadm $$
278:    core.%f.%p

Superuser can inquire about any user's core file settings by using coreadm process ID. Ordinary users can only inquire about the core file settings of their own processes.

How to Enable a Per-Process Core File Path

Become superuser.

Enable a per-process core file path.
# coreadm -e process

Display the current process core file path to verify the configuration.
$ coreadm $$ 1180: /home/kryten/corefiles/%f.%p

How to Enable a Global Core File Path

Become superuser.

Enable a global core file path.

# coreadm -e global -g /var/core/core.%f.%p

Display the current process core file path to verify the configuration.

# coreadm
     global core file pattern: /var/core/core.%f.%p
       init core file pattern: core
            global core dumps: enabled
       per-process core dumps: enabled
      global setid core dumps: disabled
 per-process setid core dumps: disabled
     global core dump logging: disabled

Troubleshooting Core File Problems

Error Message

NOTICE: 'set allow_setid_core = 1' in /etc/system is obsolete
NOTICE: Use the coreadm command instead of 'allow_setid_core'

Cause

You have an obsolete parameter that allows setuid core files in your /etc/system file.

Solution

Remove allow_setid_core=1 from the /etc/system file. Then use the coreadm command to enable global setuid core file paths.

Improved Core File Management (coreadm)