On Mon, Apr 08, 2019 at 02:21:47PM +0200, jfilak(a)fedoraproject.org wrote:
I agree, but the file /proc/meminfo is not present, right?
And yes, the abrt thing just reads the data from journal and
stores them on filesystem to be able to upload them to Bugzilla.
Regarding the missing logs, the journal log lines should
be extracted by this thing:
https://github.com/abrt/abrt/blob/master/src/plugins/ccpp_event.conf#L25
(
https://github.com/abrt/abrt/blob/master/src/plugins/ccpp_event.conf#L25)
which is a little bit complex, so no wonder if it is broken
Thanks for the link. That code boils down to
"journalctl -q -b --since=-3m --system -n 99 _COMM="$base_executable"
and for systemd services this is very underwhelming, because it doesn't
use the information that the process is part of service, and all logs
from that service are relevant, e.g. when it launches a second
executable or switches uid.
I think abrt should figure out if the crashing binary is part of a
system service, and switch to a log collection mode that is more like
'journalctl -u' in this case. Also, don't limit the messages to just 3
minutes or 99 messages.
(I am just not sure why the abrt test suite is not failing though).
Regarding the core files, I was under the impression that
the core files can be attached only if the reporter wants to attach it.
IOW the core files were never attached automatically (due to security
issues).
Could we have a per-service switch that says "this service never has
private information, make the coredump file collection opt-out"?
For example, we get a number of reports for systemd-logind, and by
design it never has any private user data or keys. The user interface
could be simplified. Similarly for hwrngd, and probably many others.
If you need some information that is relevant only to your packages,
we can work together to create a new abrt configuration which will
gather that information for your packages
(for example, dnf ships its own abrt configuration).
Can you point me to it? rpm -ql $(rpm -qa|grep dnf)|grep abrt doesn't
yield anything.
Zbyszek