How-to capture core files from Apache

Question

How-to capture core files from Apache?

Procedure

In some cases, Apache will stop unexpectedly because of a segmentation fault. To debug these types of problems, it's frequently advantageous to examine the "core dump" left by Apache when it ended.

1. Create the coredump directory:

   # mkdir -vp /home/core_files

   Note: Coredumps can be dumped to anywhere, however, it is recommended to not store these files in a user directory as they could have sensitive data.

2. Update the core_pattern kernel variable to use the coredump path:

   # echo '/home/core_files/%e.core.%t.%p' > /proc/sys/kernel/core_pattern

   Note: The %e starts the filename with the name of the executable that segfaulted, %t prints the time (in epoch), and %p adds the process id.   An example would be: /home/core_files/httpd.core.1779530456.510214

3. Enable full coredumps in the kernel:

   # echo 2 > /proc/sys/fs/suid_dumpable

4. Enable coredump processing for cPanel:

   # whmapi1 set_tweaksetting key='coredump' value=1

5. Add a systemd configuration file override:

   #  systemctl edit httpd

6. Add the following, and save the file:

   CONFIG_TEXT: [Service]
   LimitCORE=infinity

   Note: This will ensure that all relevant data is dumped to the file.

7. Reload systemd:

   # systemctl daemon-reload

8. Restart Apache:

   # /scripts/restartsrv_httpd

Now the server is ready to generate core dumps from Apache.  

Warning: Please don't forget to turn these features off when you're done, as core dumps can contain sensitive data and can be very large.

To disable coredumps:

1. Disable coredumps in cPanel:

   # whmapi1 set_tweaksetting key='coredump' value=0

2. Set the suid_dumpable kernel configuration back to 0 (disabled).

   # echo 0 > /proc/sys/fs/suid_dumpable

3. Edit the systemd configuration file override:

   # systemctl edit httpd

4. Remove the following line:

   CONFIG_TEXT: LimitCORE=infinity

5. Reload systemd:

   # systemctl daemon-reload

6. Restart Apache:

   # /scripts/restartsrv_httpd