Skip to main content

Make trisul core dump upon crash

If you need to debug a trisul crash, a core dump is a valuable tool.

Request a checked build​

The trisul executable that comes with the RPM or DEB package is stripped of debugging symbols. You can request Unleash Networks for a checked build, with all symbols intact. We will give you a file called trisul_checked built specifically for your platform.

Place the checked build in /usr/local/bin

Core file​

Trisul is a setuid program. It starts up as root, but after completing privileged work, drops down to the user specified in the Setuid parameter in trisulProbeConfig.xml. The default user is trisul.trisul.

Enable core dumping of setuid programs​

Set the value of /proc/sys/fs/suid_dumpable to 2

[root@localhost ]# cat /proc/sys/fs/suid_dumpable  
0  
[root@localhost ]# echo 2 > /proc/sys/fs/suid_dumpable  
[root@localhost ]#  
[root@localhost ]# cat /proc/sys/fs/suid_dumpable  
2

Where is the core file ?​

By default The core file will be placed in /tmp and will be called core.xxxx where xxxx is the PID of the trisul process that crashed. You can change this filename by modifying the /etc/sysctl.conf file.

Add the following line to /etc/sysctl.conf. The core file will then be called, for example, core.trisul.2239.

kernel.core_pattern=/tmp/core.%e.%p

Reload the config:

[root@localhost ~]# sysctl -p
net.ipv4.ip_forward = 0
…
kernel.core_pattern = /tmp/core.%e.%p

When it crashes​

Once Trisul crashes and you have located the core dump in /tmp, it is time to fire up gdb and determine the cause of the crash.

You must do this as root, because the saved core file is only readable by root.

gdb /usr/local/bin/trisul_checked /tmp/core.trisul.3297
(gdb) bt
.. prints the stack…

You may then send the stack trace to us so we can help fix the cause of the crash.

In this page: