On Mon, 2016-12-05 at 19:27 +0200, Török Edwin wrote:
The description here is a bit confusing, and scary: what if I run
out
of space and I need to rm the coredumps to make room?
Sorry, that description is wrong; core dumps used to be stored in the
journal and still can be, but that's not the default behavior of
systemd-coredump anymore. Thanks to Zbigniew for pointing out this
mistake on the desktop list. By default, only truncated stack traces
and metadata about the core dumps are actually stored in the journal.
The core dumps themselves will be stored in /var/lib/systemd/coredump,
where they will be removed automatically based on how old they are and
how much space they take up. See coredump.conf(5) for more information
on these settings and how to change them. I've edited the change page
to be more accurate.
Even though [1] says "By default, systemd-coredump will log the
core
dump including a backtrace if possible to the journal and store the
core dump itself in an external file in /var/lib/systemd/coredump."
This sounds good, I can rm the coredump and not loose the system log
(or the fact that a coredump occured).
Yes, this is correct.
But [1] also says "Core dumps can be written to the journal or
saved
as a file".
This is confusing, because you say the only change is to disable an
ABRT service:
Writing core dumps to the journal is a non-default option. By default,
they will be saved to a file, not the journal.
Currently abrt-ccpp.service intercepts all core dumps before they ever
reach systemd-coredump, so the only change needed to get coredumpctl
working is indeed to disable that service.
But by default systemd would store core dumps in a file, and not in
the system journal, so am I correct that this change entry's
description should be changed to:
"Enable coredumpctl by default. Core dumps will be logged in the
system
journal and stored in /var/lib/systemd/coredump rather than created
in the crashing process's current working
directory by ABRT."
Yes you are correct. I've changed the page accordingly.
> However, it must be admitted that ABRT's feature
> set will be slightly smaller with abrt-ccpp.service disabled.
> Notably,
> crash-time stacktraces will no longer be available as all
> stacktraces
> will be generated from core files extracted from the system
> journal.
same change: retrieved from /var/lib/systemd/coredump
We're not actually sure if this will really regress, so I've just
removed it from the change page.
Thanks for the feedback,
Michael