Working with the Automatic Bug Reporting Tool

If the Automatic Bug Reporting Tool, abrt, is running then core dumps continue to be generated for a system, even if you have disabled the core dump facility. On a production system, it can optionally be disabled or uninstalled entirely.

Note:

The Automatic Bug Reporting Tool has been deprecated. Consider using systemd-coredump feature instead. For more information about using the coredumpctl command, see Oracle Linux 8: Monitoring and Tuning the System and the systemd-coredump manual pages.

To stop and disable the abrtd service entirely, run:

sudo systemctl disable --now abrtd

When running the service, you can restrict the service so that it only analyzes core dumps for binaries installed using signed packages. You can also prevent the service from analyzing particular binaries that reveal sensitive information in a dump by adding them to a denylist.

For example, edit /etc/abrt/abrt-action-save-package-data.conf to set the following parameters:

# Require a GPG signature for a package
OpenGPGCheck = yes                                             
 
# Add any package names to the Blacklist that contain binaries 
# that you want abrt to not store dump data for
BlackList = nspluginwrapper, valgrind, strace, mono-core, bash

# Disable processing of unpackaged binaries
ProcessUnpackaged = no

# Add any paths to the BlackListedPaths that may contain binary 
# executables that you want abrt to not store dump data for
BlackListedPaths = /usr/share/doc/*, */example*, /usr/bin/nspluginviewer, \
     /usr/lib*/firefox/plugin-container      

Note that although the BlackList and BlackListedPaths options can be used to prevent the service from storing dump data, the dumps are still generated and written to disk for a short time before being removed, so that abrtd can notify system administrators about a crash without using up disk space.

To prevent the core dumps from being written to disk, and prevent abrtd from detecting crashes in an application, edit the /etc/abrt/plugins/CCpp.conf file and add the absolute path of the binary to the IgnoredPaths list. For example:

IgnoredPaths = /path/to/binary