Recently it happened that a virtual machine crashed reproducible. journalctl contained messages from audit indicating the crash:
audit[88047]: ANOM_ABEND auid=4294967295 uid=107 gid=107 ses=4294967295 subj=system_u:system_r:svirt_t:s0:c422,c704 pid=88047 comm="qemu-system-x86" exe="/usr/bin/qemu-system-x86_64" sig=6 res=1
I was hoping to get a coredump from it, however, coredumpctl had no corefile (COREFILE column read “none”). There was another message in journalctl which also showed the reason:
systemd-coredump[90346]: Resource limits disable core dumping for process 88047 (qemu-system-x86).
However, ulimit -a (even as user qemu) showed that core file size is unlimited. It seems that something (probably virsh) adjusts limits for that particular process (Max core file size is set to 0 and 0 bytes).
$ cat /proc/$(pidof qemu-system-x86_64)/limits Limit Soft Limit Hard Limit Units Max cpu time unlimited unlimited seconds Max file size unlimited unlimited bytes Max data size unlimited unlimited bytes Max stack size 8388608 unlimited bytes Max core file size 0 0 bytes Max resident set unlimited unlimited bytes Max processes 386482 386482 processes Max open files 8192 8192 files Max locked memory 65536 65536 bytes Max address space unlimited unlimited bytes Max file locks unlimited unlimited locks Max pending signals 386482 386482 signals Max msgqueue size 819200 819200 bytes Max nice priority 0 0 Max realtime priority 0 0 Max realtime timeout unlimited unlimited us
The tool prlimit allows to adjust ulimits for a particular process. Setting core fiel size to -1 will set it to unlimited. With the limits adjusted the next coredump will succeed.
# prlimit --core=-1 -p $(pidof qemu-system-x86_64)