The opencore.sh from getappcore fails to properly open the core file
This document (000020617) is provided subject to the disclaimer at the end of this document.
Environment
SUSE Linux Enterprise Server 12 (All Service Packs)
Situation
sles15sp3:~ # ls -l /var/lib/systemd/coredump/ total 44 -rw-r----- 1 root root 44648 Mar 16 11:36 core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zstThe getappcore tool is used to capture the core file data.
sles15sp3:~ # getappcore -b /usr/sbin/cron /var/lib/systemd/coredump/core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zstWhen attempting to open the application core for analysis, the following error is observed:
sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore # ./opencore.sh [...] ./opencore.ini:14: Error in sourced command file: "/var/log/scc_sles15sp3_cron_220316_114320_appcore/./var/lib/systemd/coredump/core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst" is not a core dump: file format not recognized sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore/var/lib/systemd/coredump # file core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst: Zstandard compressed data (v0.8+), Dictionary ID: NoneThe core is extracted and the opencore.ini updated to reflect the filename change.
sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore/var/lib/systemd/coredump # zstd -d core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst: 1421312 bytes sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore/var/lib/systemd/coredump # file core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000 core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/sbin/cron -n', real uid: 0, effective uid: 0, real gid: 0, effective gid: 0, execfn: '/usr/sbin/cron', platform: 'x86_64' sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore # cat opencore.ini [...] # Core file: file ./usr/sbin/cron core ./var/lib/systemd/coredump/core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000Even though the extracted file is now a valid application core file format, the following shared library error is observed with opencore.sh.
sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore # ./opencore.sh [...] warning: Could not load shared library symbols for 7 libraries, e.g. /lib64/libselinux.so.1. Use the "info sharedlibrary" command to see the complete listing. Do you need "set solib-search-path" or "set sysroot"?
Resolution
sles15sp3:~ # coredumpctl list TIME PID UID GID SIG COREFILE EXE Wed 2022-03-16 11:36:40 MDT 1893 0 0 11 present /usr/sbin/cron ^^^^ sles15sp3:~ # getappcore -j 1893
Cause
Additional Information
Generally the -b option is not needed if getappcore can properly read the core file being collected.
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000020617
- Creation Date: 16-Mar-2022
- Modified Date:17-Mar-2022
-
- SUSE Linux Enterprise Server
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com