[systemd-devel] Recommended way of running additional event handlers on coredumps?

[Luca Boccassi]

On Fri, 9 May 2025 at 11:45, Johannes Barthel
<johannes.barthel at farming-revolution.com> wrote:
>
> Hi,
>
> we're using an Ubuntu setup where systemd-coredump is set up as the coredump handler. This is fine, coredumps end up in /var/lib/systemd/coredump/. We would however like to additionally run our own event handler (for remote error reporting) in case of a process dumping core.
>
> Does systemd-coredump provide any facilities for registering an event handler for this? Or should we create our own handler, register that as kernel.core_pattern in sysctl and forward the coredumps to systemd-coredump? I considered subscribing to the journal and filtering the coredump event out there, but that might cause unnecessary CPU load and also the API seems to be kind of broken, I ran into this issue [1].
>
> What is the best way of running our custom error reporting script in addition to systemd-coredump's default behavior?

You can use a path unit pointed to /var/lib/systemd/coredump, or any
other similar inotify-based mechanism, and you can do any
postprocessing you need based on such triggers. We use this scheme to
export core files and it works fine.