Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Systemd core dump management gets process name wrong #172
Mostly, the new systemd core dump management gets file names right, e.g. a "node" process crash in a docker container is correctly labelled as
Occasionally, though, a crash will get mislabelled
we have verified that these are core dumps for "node" rather than kworker or btrfs-freespace.
@crawford yes, this has always been a pain. The systemd coredump utility hasn't a clue how to deal with PID namespaces so it uses the container PID but grabs process info from the main namespace.
I don't know why this is the case, it seems like a pretty surprising oversight for systemd...
The actual problem here is that the default /usr/lib/sysctl.d/50-coredump.conf shipped with systemd (and CoreOS) sets the core dump command to '/usr/lib/systemd/systemd-coredump %p %u %g %s %t %e', where %p is the "PID of dumped process, as seen in the PID namespace in which the process resides" (according to http://man7.org/linux/man-pages/man5/core.5.html ) -- so systemd-coredump already gets the wrong PID passed in. Just changing %p to %P ("PID of dumped process, as seen in the initial PID namespace (since Linux 3.12)") seems to fix this.
I don't know whether there is a rationale for using %p rather than %P in systemd upstream, or it's just an oversight -- but I don't see any obvious reason not to change this default in CoreOS at least?
referenced this issue
Nov 17, 2015
We should absolutely make that change.