'\" t
.TH "COREDUMP\&.CONF" "5" "" "systemd 258.3" "coredump.conf"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
coredump.conf, coredump.conf.d \- Core dump storage configuration files
.SH "SYNOPSIS"
.PP
.RS 4
/etc/systemd/coredump\&.conf
.RE
.RS 4
/run/systemd/coredump\&.conf
.RE
.RS 4
/usr/local/lib/systemd/coredump\&.conf
.RE
.RS 4
/usr/lib/systemd/coredump\&.conf
.RE
.RS 4
/etc/systemd/coredump\&.conf\&.d/*\&.conf
.RE
.RS 4
/run/systemd/coredump\&.conf\&.d/*\&.conf
.RE
.RS 4
/usr/local/lib/systemd/coredump\&.conf\&.d/*\&.conf
.RE
.RS 4
/usr/lib/systemd/coredump\&.conf\&.d/*\&.conf
.RE
.SH "DESCRIPTION"
.PP
These files configure the behavior of
\fBsystemd-coredump\fR(8), a handler for core dumps invoked by the kernel\&. Whether
\fBsystemd\-coredump\fR
is used is determined by the kernel\*(Aqs
\fIkernel\&.core_pattern\fR
\fBsysctl\fR(8)
setting\&. See
\fBsystemd-coredump\fR(8)
and
\fBcore\fR(5)
pages for the details\&.
.SH "CONFIGURATION DIRECTORIES AND PRECEDENCE"
.PP
The default configuration is set during compilation, so configuration is only needed when it is necessary to deviate from those defaults\&. The main configuration file is loaded from one of the listed directories in order of priority, only the first file found is used:
/etc/systemd/,
/run/systemd/,
/usr/local/lib/systemd/
\&\s-2\u[1]\d\s+2,
/usr/lib/systemd/\&. The vendor version of the file contains commented out entries showing the defaults as a guide to the administrator\&. Local overrides can also be created by creating drop\-ins, as described below\&. The main configuration file can also be edited for this purpose (or a copy in
/etc/
if it is shipped under
/usr/), however using drop\-ins for local configuration is recommended over modifications to the main configuration file\&.
.PP
In addition to the main configuration file, drop\-in configuration snippets are read from
/usr/lib/systemd/*\&.conf\&.d/,
/usr/local/lib/systemd/*\&.conf\&.d/, and
/etc/systemd/*\&.conf\&.d/\&. Those drop\-ins have higher precedence and override the main configuration file\&. Files in the
*\&.conf\&.d/
configuration subdirectories are sorted by their filename in lexicographic order, regardless of in which of the subdirectories they reside\&. When multiple files specify the same option, for options which accept just a single value, the entry in the file sorted last takes precedence, and for options which accept a list of values, entries are collected as they occur in the sorted files\&.
.PP
When packages need to customize the configuration, they can install drop\-ins under
/usr/\&. Files in
/etc/
are reserved for the local administrator, who may use this logic to override the configuration files installed by vendor packages\&. Drop\-ins have to be used to override package drop\-ins, since the main configuration file has lower precedence\&. It is recommended to prefix all filenames in those subdirectories with a two\-digit number and a dash, to simplify the ordering\&. This also defines a concept of drop\-in priorities to allow OS vendors to ship drop\-ins within a specific range lower than the range used by users\&. This should lower the risk of package drop\-ins overriding accidentally drop\-ins defined by users\&. It is recommended to use the range 10\-40 for drop\-ins in
/usr/
and the range 60\-90 for drop\-ins in
/etc/
and
/run/, to make sure that local and transient drop\-ins take priority over drop\-ins shipped by the OS vendor\&.
.PP
To disable a configuration file supplied by the vendor, the recommended way is to place a symlink to
/dev/null
in the configuration directory in
/etc/, with the same filename as the vendor configuration file\&.
.SH "OPTIONS"
.PP
All options are configured in the [Coredump] section:
.PP
\fIStorage=\fR
.RS 4
Controls where to store cores\&. One of
"none",
"external", and
"journal"\&. When
"none", the core dumps may be logged (including the backtrace if possible), but not stored permanently\&. When
"external"
(the default), cores will be stored in
/var/lib/systemd/coredump/\&. When
"journal", cores will be stored in the journal and rotated following normal journal rotation patterns\&.
.sp
When cores are stored in the journal, they might be compressed following journal compression settings, see
\fBjournald.conf\fR(5)\&. When cores are stored externally, they will be compressed by default, see below\&.
.sp
Note that in order to process a coredump (i\&.e\&. extract a stack trace) the core must be written to disk first\&. Thus, unless
\fIProcessSizeMax=\fR
is set to 0 (see below), the core will be written to
/var/lib/systemd/coredump/
either way (under a temporary filename, or even in an unlinked file),
\fIStorage=\fR
thus only controls whether to leave it there even after it was processed\&.
.sp
Added in version 215\&.
.RE
.PP
\fICompress=\fR
.RS 4
Controls compression for external storage\&. Takes a boolean argument, which defaults to
"yes"\&.
.sp
Added in version 215\&.
.RE
.PP
\fIProcessSizeMax=\fR
.RS 4
The maximum size in bytes of a core which will be processed\&. Core dumps exceeding this size may be stored, but the stack trace will not be generated\&. Like other sizes in this same config file, the usual suffixes to the base of 1024 are allowed (B, K, M, G, T, P, and E)\&. Defaults to 1G on 32\-bit systems, 32G on 64\-bit systems\&.
.sp
Setting
\fIStorage=none\fR
and
\fIProcessSizeMax=0\fR
disables all coredump handling except for a log entry\&.
.sp
Added in version 215\&.
.RE
.PP
\fIEnterNamespace=\fR
.RS 4
For processes belonging to a PID namespace, controls whether
\fBsystemd-coredump\fR(8)
shall attempt to process core dumps on the host, using debug information from the file system hierarchy (i\&.e\&. the mount namespace) of the process that crashed\&. Access to the process\*(Aq file system hierarchy might be necessary to generate a fully symbolized backtrace\&. If set to
"yes",
\fBsystemd\-coredump\fR
will obtain the tree of mounts from the crashing process\*(Aq mount namespace and will try to generate the stack trace in host context using the debug information of binaries and libraries contained in the crashing process\*(Aq hierarchy\&. Defaults to
"no", i\&.e\&. no attempt is made to acquire external debug information from the process\*(Aq mount namespace, in order to maximize security\&. This option has no effect on processes that are part of the host\*(Aqs PID namespace\&.
.sp
Note that the coredump of the namespaced process is still saved in
/var/lib/systemd/coredump/
on the host even if
\fIEnterNamespace=\fR
is set to
"no"
(subject to
\fIStorage=\fR)\&.
.sp
Note that
\fIEnterNamespace=\fR
only has an effect if a core dump is generated by a container whose unit does not have
\fICoredumpReceive=\fR
enabled\&.
.sp
Note that it\*(Aqs typically preferable to let containers and other namespace\-based sandboxes process their own coredumps, if possible, for best security\&. This may be enabled on the container\*(Aqs unit via the
\fICoredumpReceive=\fR
setting, see
\fBsystemd.resource-control\fR(5)
for details\&.
.sp
Added in version 257\&.
.RE
.PP
\fIExternalSizeMax=\fR, \fIJournalSizeMax=\fR
.RS 4
The maximum (compressed or uncompressed) size in bytes of a coredump to be saved in separate files on disk (default: 1G on 32\-bit systems, 32G on 64\-bit systems) or in the journal (default: 767M)\&. Note that the journal service enforces a hard limit on journal log records of 767M, and will ignore larger submitted log records\&. Hence,
\fIJournalSizeMax=\fR
may be lowered relative to the default, but not increased\&. Unit suffixes are allowed just as in
\fBProcessSizeMax=\fR\&.
.sp
\fIExternalSizeMax=infinity\fR
sets the core size to unlimited\&.
.sp
Added in version 215\&.
.RE
.PP
\fIMaxUse=\fR, \fIKeepFree=\fR
.RS 4
Enforce limits on the disk space, specified in bytes, taken up by externally stored core dumps\&. Unit suffixes are allowed just as in
\fBProcessSizeMax=\fR\&.
\fBMaxUse=\fR
makes sure that old core dumps are removed as soon as the total disk space taken up by core dumps grows beyond this limit (defaults to 10% of the total disk size)\&.
\fBKeepFree=\fR
controls how much disk space to keep free at least (defaults to 15% of the total disk size)\&. Note that the disk space used by core dumps might temporarily exceed these limits while core dumps are processed\&. Note that old core dumps are also removed based on time via
\fBsystemd-tmpfiles\fR(8)\&. Set either value to 0 to turn off size\-based cleanup\&.
.sp
Added in version 215\&.
.RE
.PP
Use
.sp
.if n \{\
.RS 4
.\}
.nf
systemd\-analyze cat\-config systemd/coredump\&.conf
.fi
.if n \{\
.RE
.\}
.sp
to display the full config\&.
.SH "SEE ALSO"
.PP
\fBsystemd-journald.service\fR(8), \fBcoredumpctl\fR(1), \fBsystemd-tmpfiles\fR(8)
.SH "NOTES"
.IP " 1." 4
💣💥🧨💥💥💣 Please note that those configuration files must be available at all times. If
/usr/local/
is a separate partition, it may not be available during early boot, and must not be used for configuration.

