Lately, I'm seeing a weird behavior of abrt happening over and over again:
Although I have just a few (say, 4) smaller crashes (not WebKit or Firefox), which take up little space on my disk, when a new crash happens, some or even all crashes are deleted. abrtd then reports to syslog: abrtd[896]: Size of '/var/spool/abrt' >= 25000 MB (MaxCrashReportsSize), deleting old directory 'ccpp-2016-12-…
This way, I never get more than 6 crashes listed by gnome-abrt or abrt-cli. Sometimes, abrt even deletes all my crash directories, including small python backtraces with just a few megabytes.
I don't understand why this happens. Can you please tell me? Is this a bug?
After the last crash happened (firefox, https://bugzilla.redhat.com/show_bug.cgi?id=1404439), all crashes were deleted. This is the filesystem state of abrt directories after that crash:
/var/cache/abrt-di is 800 MB although there is no crash present any more. /var/spool/abrt-upload is empty. /var/spool/abrt and /var/lib/abrt and /var/run/abrt just contain some very small files.
This is all abrt-related stuff in my syslog from last boot, where abrt deleted all my crashes (19:25:58): https://gist.github.com/anonymous/348e3101aa18c5f0d862f8396a3f97f0
I already tried to purge/delete all the files listed above and reinstall all of abrt, but there is no change, the issue doesn't go away.
Two probably unrelated questions: 1. I know that the "firefox" package is signed with a proper key, but I installed it from command line after manually downloading it from koji. Abrt throws away this crash and logs:
Dez 13 21:13:14 hostname abrt-hook-ccpp[3199]: Process 30672 (firefox) of user 1000 killed by SIGSEGV - dumping core Dez 13 21:13:15 hostname abrt-hook-ccpp[3199]: Failed to create core_backtrace: PTRACE_SEIZE (tid 30766) failed: Operation not permitted Dez 13 21:13:15 hostname abrt-server[3202]: Package 'firefox' isn't signed with proper key Dez 13 21:13:15 hostname abrt-server[3202]: 'post-create' on '/var/spool/abrt/ccpp-2016-12-13-21:13:14-30672' exited with 1 Dez 13 21:13:15 hostname abrt-server[3202]: Deleting problem directory '/var/spool/abrt/ccpp-2016-12-13-21:13:14-30672'
What am I doing wrong?
Because of abrt deleting my crashes, I get these a lot: "ignoring (repeated crash)". How can I reset abrt's behavior about crashes it has seen before?
Miroslav Suchý wrote:
See /etc/abrt/abrt.conf: # Max size for crash storage [MiB] or 0 for unlimited # MaxCrashReportsSize = 1000
I don't understand.
In my /etc/abrt/abrt.conf, I've set
MaxCrashReportsSize = 25000
So no, the limit is not reached for sure if I get just 1…5 simple crashes. ABRT is just taking some hundred MiB on my disk, not 25 GiB.
Hello,
Lately, I'm seeing a weird behavior of abrt happening over and over again:
Although I have just a few (say, 4) smaller crashes (not WebKit or Firefox), which take up little space on my disk, when a new crash happens, some or even all crashes are deleted. abrtd then reports to syslog: abrtd[896]: Size of '/var/spool/abrt' >= 25000 MB (MaxCrashReportsSize), deleting old directory 'ccpp-2016-12-…
This way, I never get more than 6 crashes listed by gnome-abrt or abrt-cli. Sometimes, abrt even deletes all my crash directories, including small python backtraces with just a few megabytes.
If MaxCrashReportsSize is not reached and crashes are still deleted it is probably a bug. What OS (distro and version) are you using?
Two probably unrelated questions:
- I know that the "firefox" package is signed with a proper key, but I
installed it from command line after manually downloading it from koji. Abrt throws away this crash and logs:
Dez 13 21:13:14 hostname abrt-hook-ccpp[3199]: Process 30672 (firefox) of user 1000 killed by SIGSEGV - dumping core Dez 13 21:13:15 hostname abrt-hook-ccpp[3199]: Failed to create core_backtrace: PTRACE_SEIZE (tid 30766) failed: Operation not permitted Dez 13 21:13:15 hostname abrt-server[3202]: Package 'firefox' isn't signed with proper key Dez 13 21:13:15 hostname abrt-server[3202]: 'post-create' on '/var/spool/abrt/ccpp-2016-12-13-21:13:14-30672' exited with 1 Dez 13 21:13:15 hostname abrt-server[3202]: Deleting problem directory '/var/spool/abrt/ccpp-2016-12-13-21:13:14-30672'
What am I doing wrong?
If you install packages manually from koji, package are not signed and you have to set 'OpenGPGCheck' option to 'yes' in /etc/abrt/abrt-action-save-package-data.conf to catch such a crashes.
Because of abrt deleting my crashes, I get these a lot: "ignoring (repeated crash)". How can I reset abrt's behavior about crashes it has seen before?
Removing /var/spool/abrt/last-ccpp file should help.
Matej
If MaxCrashReportsSize is not reached and crashes are still deleted it is probably a bug. What OS (distro and version) are you using?
Fedora 25. Any details to attach to the bug?
If you install packages manually from koji, package are not signed and you have to set 'OpenGPGCheck' option to 'yes' in /etc/abrt/abrt-action-save-package-data.conf to catch such a crashes.
Thanks!
Removing /var/spool/abrt/last-ccpp file should help.
Matej
Thank you!
Hi Christian,
unfortunately, the thing with ABRT deleting crash reports is not a bug, it's a feature.
ABRT tries to be smart and to not to destroy your machine by filling 100% disk space - running out of disk space a big problem. This goal is achieved by a check for _free space_ on the partition with DumpLocation (usually / var/spool/abrt). If free space is lower than MaxCrashReportsSize/4, ABRT goes to remove its files. So with higher MaxCrashReportsSize you need more free disk space.
While I like this effort, the implementation deserves to be made it more wise and the log message must be definitely updated, because it doesn't tell you what's wrong.
"> If MaxCrashReportsSize is not reached and crashes are still deleted
it is probably a bug. What OS (distro and version) are you using?
Fedora 25. Any details to attach to the bug?
If you install packages manually from koji, package are not signed and you
have to
set 'OpenGPGCheck' option to 'yes' in /etc/abrt/abrt-action-save-package-data.conf to catch such a crashes.
Thanks!"
Eh, Matej, you wanted to write 'no', right? Because Christian wants stop ABRT from dropping crashes of unsigned packages.
"""
Removing /var/spool/abrt/last-ccpp file should help.
Matej
Thank you! "
Best regards,
Jakub
I have 116 GiB of free disk space, that's more than 4*MaxCrashReportsSize. MaxCrashReportsSize is 25000 MiB. All crashes never take up more than 2 GiB on my disk before ABRT starts deleting them. When ABRT starts deleting bugs, it often deletes all of them or all but one even though the last remaining crash just takes ~16 MiB on my disk. Still sounds like a bug to me.
crash-catcher@lists.fedorahosted.org
-
Christian Stadelmann -
Jakub Filak -
Matej Habrnal