Generate an Enforcer core dump for analysis

This document (000021214) is provided subject to the disclaimer at the end of this document.

Environment

By default, the kernel.core_pattern is not configured. Sometimes it may be necessary to generate a core dump from an unexpected Enforcer error for our team to analyze and rectify the issue.

Resolution

To generate the core dump file, exec into the Enforcer with the abnormal process termination and set the kernel.core_pattern.

kubectl exec -ti <enforcer name> -n neuvector -- sh
#inside enforcer pod execute
sysctl -w kernel.core_pattern=/tmp/core-%e.%p.%h.%t

Cause

The following is an example log entry from the Enforcer where the dp process terminated unexpectedly. Once you have the kernel.core_pattern configured, you should find the core file under /tmp folder within the Enforcer with name similar to the pattern core-dp.<PID>.neuvector-enforcer-pod-xxxx.####.

2023-11-06T18:29:59|MON|Process dp exit status -1, pid=2291993

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.