LinuxQuestions.org - core files appending PIDS

- Linux - Enterprise (https://www.linuxquestions.org/questions/linux-enterprise-47/)

- - core files appending PIDS - they shouldn't be! (https://www.linuxquestions.org/questions/linux-enterprise-47/core-files-appending-pids-they-shouldnt-be-313320/)

core files appending PIDS - they shouldn't be!

Hey all, this is my first post to linuxquestions.org. I'm hoping one of you geniuses out there can help!

I have a set of enterprise servers running Redhat Linux 7.3 (don't ask me why, I'm not the SA). It looks like everything is set so that no PIDs should be attached to my core files, however, they are still being attached.

[dce3@/usr/local/dce3]>cat /proc/sys/kernel/core_uses_pid
0
[dce3@/usr/local/dce3]>cat /proc/sys/kernel/core_pattern
core
[dce3@/usr/local/dce3]>ls -l core.25745
-rw------- 1 dce3 dce3 573911040 Apr 14 22:23 core.25745
[dce3@/usr/local/dce3]>

Can anyone shed some light on this?!?! Everything I've seen says that the 2 files above dictate whether or not the PID is attached, and my box seems to be consistent with what I've read on the web.

Just to check, did you generate the core dump file after changing the settings in /proc/? This may be stating the obvious, but the settings will only effect new core dump files; it won't go through and modify the hard disk for you.

core_uses_pid should only be ignored if core_pattern contains %p.

You'll find the code that builds the filename in /usr/src/linux/fs/exec.c (if you have the kernel sources installed); the function is called format_corename. You didn't specify your kernel version, but I have (for the appending core bit):

Code:

if (!pid_in_pattern

            && (core_uses_pid || atomic_read(&current->mm->mm_users) != 1)) {

                rc = snprintf(out_ptr, out_end - out_ptr,

                              ".%d", current->tgid);

                if (rc > out_end - out_ptr)

                        goto out;

                out_ptr += rc;

        }

So it will also be ignored if mm_users is not 1; I am not sure what mm_users actually is (it's part of the mm_struct structure which deals with memory mapping) but it seems to be related to the number of users involved with the given process. Can anyone shed some more light on this?

Of course, if you never want the PID, then you can always hack it by deleteing the block of code above from the kernel and recompiling. But you'll then have to repeat this process every kernel update…

This was definitely done after the core_uses_pid file was updated (just to be sure, I did this again, just now):

Code:

[dce3@/usr/local/dce3]>rm core.25745

[dce3@/usr/local/dce3]>ls

COPYRIGHT  bin  brix  data  etc  lib  lost+found  mibs  tmp  var

[dce3@/usr/local/dce3]>bin/run_dce

[dce3@/usr/local/dce3]>pkill -7 dce.ip

[dce3@/usr/local/dce3]>ls -l core.2159

-rw-------    1 dce3    dce3    573911040 Apr 15 19:20 core.2159

[dce3@/usr/local/dce3]>

Hacking and recompiling the kernel is really not an option. Any other ideas??