How to increase the retention time of /var/lib/systemd/coredump

This document (7023701) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12 Service Pack 3 (SLES 12 SP3)
SUSE Linux Enterprise Server 12 Service Pack 2 (SLES 12 SP2)
SUSE Linux Enterprise Server 12 Service Pack 1 (SLES 12 SP1)

Situation

An application exists abnormally and a core dump is reported in the systemd journal. The file was requested in the course of a support request, e.g.:

miniontest:~ # coredumpctl list
TIME PID UID GID SIG PRESENT EXE
Fri 2019-02-01 08:53:11 CET 32346 0 0 7 /usr/bin/top

but when trying to extract it according to the information in TID 7017137 - How to obtain systemd core dumps

the command returns "No such file or directory":

miniontest:~ # coredumpctl -o core.top dump /usr/bin/top
           PID: 32346 (top)
           UID: 0 (root)
           GID: 0 (root)
        Signal: 7 (BUS)
     Timestamp: Fri 2019-02-01 08:53:11 CET (4 days ago)
Command Line: top
    Executable: /usr/bin/top
Control Group: /user.slice/user-0.slice/session-667.scope
          Unit: session-667.scope
         Slice: user-0.slice
       Session: 667
     Owner UID: 0 (root)
       Boot ID: 93ce963772084db699b11679c13034b7
    Machine ID: 68fab2bd0879e9143c8210f55c4b0978
      Hostname: miniontest
       Message: Process 32346 (top) of user 0 dumped core.
Cannot retrieve coredump from journal nor disk.
Coredump retrieval failed: No such file or directory

Resolution

Create a file like /etc/tmpfiles.d/core.conf with the following content:

d /var/lib/systemd/coredump 0755 root root 14d

Keep in mind though, that depending on the failing application the /var/ file system may require additional monitoring as disk space usage may increase due to the longer retention time. For further details on the settings please see "man 5 tmpfiles.d".

Cause

The default retention policy for /var/lib/systemd/coredump is configured in /usr/lib/tmpfiles.d/systemd.conf and according to "man 5 tmpfiles.d" may get overridden by creating respective *.conf files in /etc/tmpfiles.d/. For systems operating in enterprise environments a retention time of three days may not be suffcient.

Additional Information

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.