The opencore.sh from getappcore fails to properly open the core file

This document (000020617) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 15 (All Service Packs)
SUSE Linux Enterprise Server 12 (All Service Packs)

Situation

An application core file exists.

sles15sp3:~ #  ls -l /var/lib/systemd/coredump/
total 44
-rw-r----- 1 root root 44648 Mar 16 11:36 core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst

The getappcore tool is used to capture the core file data.

sles15sp3:~ # getappcore -b /usr/sbin/cron /var/lib/systemd/coredump/core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst

When attempting to open the application core for analysis, the following error is observed:

sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore # ./opencore.sh 
[...]
./opencore.ini:14: Error in sourced command file:
"/var/log/scc_sles15sp3_cron_220316_114320_appcore/./var/lib/systemd/coredump/core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst" 
is not a core dump: file format not recognized

sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore/var/lib/systemd/coredump # file core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst 
core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst:
 Zstandard compressed data (v0.8+), Dictionary ID: None

The core is extracted and the opencore.ini updated to reflect the filename change.

sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore/var/lib/systemd/coredump # zstd -d core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst 
core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000.zst: 1421312 bytes 

sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore/var/lib/systemd/coredump # file core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000
core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000: 
ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/sbin/cron -n', 
real uid: 0, effective uid: 0, real gid: 0, effective gid: 0, 
execfn: '/usr/sbin/cron', platform: 'x86_64'

sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore # cat opencore.ini 
[...]
# Core file:
file ./usr/sbin/cron
core ./var/lib/systemd/coredump/core.cron.0.28ab0cd6798d44eb81a36636e34e6580.1893.1647452200000000

Even though the extracted file is now a valid application core file format, the following shared library error is observed with opencore.sh.

sles15sp3:/var/log/scc_sles15sp3_cron_220316_114320_appcore # ./opencore.sh 
[...]
warning: Could not load shared library symbols for 7 libraries, e.g. /lib64/libselinux.so.1.
Use the "info sharedlibrary" command to see the complete listing.
Do you need "set solib-search-path" or "set sysroot"?

Resolution

Use getappcore -j <PID> to extract the core from the core dump journal.

sles15sp3:~ # coredumpctl list
TIME                            PID   UID   GID SIG COREFILE  EXE
Wed 2022-03-16 11:36:40 MDT    1893     0     0  11 present   /usr/sbin/cron
                               ^^^^

sles15sp3:~ # getappcore -j 1893

Cause

Using getappcore to collect compressed core files is unsupported. They must be decompressed first or extracted from the journal.

Additional Information

Different compression methods are used to compress an application core file. SLES 12 uses xz, while SLES 15 uses zstd. They use compression libraries and zstd is not even installed by default on SLES 15. So it is best to use getappcore -j <PID> to extract the core.

Generally the -b option is not needed if getappcore can properly read the core file being collected.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.