[systemd-devel] systemd-coredump, coredump is truncated to exactly 2GiB

[Zbigniew Jędrzejewski-Szmek]

On Sat, Jul 23, 2016 at 02:10:51PM -0600, Chris Murphy wrote:
> On Sat, Jul 23, 2016 at 11:41 AM, Zbigniew Jędrzejewski-Szmek
> <zbyszek at in.waw.pl> wrote:
> > On Fri, Jul 22, 2016 at 07:40:25PM -0600, Chris Murphy wrote:
> >> qemu-system-x86 core dumped on me for some reason, and I see it in the journal:
> >>
> >> Jul 22 13:24:30 f24m systemd-coredump[3914]: Process 3829
> >> (qemu-system-x86) of user 107 dumped core.
> >>
> >> OK no problem.
> >>
> >> [chris at f24m ~]$ sudo coredumpctl gdb 3829
> >> [...snip...]
> >> BFD: Warning: /var/tmp/coredump-DtRBEA is truncated: expected core
> >> file size >= 4115308544, found: 2147483648.
> >>
> >> OK let's extract the coredump to its own file:
> >>
> >> # sudo coredumpctl -o qemu-system-x86.coredump dump /usr/bin/qemu-system-x86_64
> >> # ls -l
> >> -rw-r--r--. 1 chris chris 2147483648 Jul 22 14:08 qemu-system-x86.coredump
> >>
> >> Huh, 2147483648 is 0x80000000 or exactly 2GiB. Suspicious? Is there a
> >> misconfiguration of some kind causing this truncation? Or?
> >>
> >> This is Fedora 24, systemd-229-8.fc24.x86_64
> >
> > Sounds like a bug in the logic. 2GiB is the default value for ProcessSizeMax=
> > and ExternalSizeMax=. coredump.conf(5) implies coredumps larger than that
> > will not be stored. I don't think it's useful to have truncated coredumps,
> > so I think we should:
> > 1. make sure that coredumps which exceed the allowed size not saved
> > 2. consider increasing the maximum coredump size. 2GiB feels a bit low
> >    in this day and age.
> 
> What's the significance of the path in the gdb complaint...
> 
> BFD: Warning: /var/tmp/coredump-S2qIGu is truncated: expected core
> file size >= 4115308544, found: 2147483648.
> 
> ...compared to the path coredumpctl info reports?
> 
>       Coredump:
> /var/lib/systemd/coredump/core.qemu-system-x86.107.b91161300395440f96b49cd0b879488d.3829.1469215461000000000000.lz4
> 
> Does 'coredumpctl gdb' grab the compressed coredump and decompresses
> it into /var/tmp and then hands it off to gdb? I just want to make
> sure there's no other source for truncation.

Yes, coredumps are stored with lz4 compression. GDB (and also other
tools) needs it uncompressed.

Zbyszek