[systemd-devel] systemd-coredump, coredump is truncated to exactly 2GiB

[Zbigniew Jędrzejewski-Szmek]

On Fri, Jul 22, 2016 at 07:40:25PM -0600, Chris Murphy wrote:
> qemu-system-x86 core dumped on me for some reason, and I see it in the journal:
> 
> Jul 22 13:24:30 f24m systemd-coredump[3914]: Process 3829
> (qemu-system-x86) of user 107 dumped core.
> 
> OK no problem.
> 
> [chris at f24m ~]$ sudo coredumpctl gdb 3829
> [...snip...]
> BFD: Warning: /var/tmp/coredump-DtRBEA is truncated: expected core
> file size >= 4115308544, found: 2147483648.
> 
> OK let's extract the coredump to its own file:
> 
> # sudo coredumpctl -o qemu-system-x86.coredump dump /usr/bin/qemu-system-x86_64
> # ls -l
> -rw-r--r--. 1 chris chris 2147483648 Jul 22 14:08 qemu-system-x86.coredump
> 
> Huh, 2147483648 is 0x80000000 or exactly 2GiB. Suspicious? Is there a
> misconfiguration of some kind causing this truncation? Or?
> 
> This is Fedora 24, systemd-229-8.fc24.x86_64

Sounds like a bug in the logic. 2GiB is the default value for ProcessSizeMax=
and ExternalSizeMax=. coredump.conf(5) implies coredumps larger than that
will not be stored. I don't think it's useful to have truncated coredumps,
so I think we should:
1. make sure that coredumps which exceed the allowed size not saved
2. consider increasing the maximum coredump size. 2GiB feels a bit low
   in this day and age.

Zbyszek