systemd coredump.conf 5 coredump.conf coredump.conf.d Core dump storage configuration files /etc/systemd/coredump.conf /run/systemd/coredump.conf /usr/local/lib/systemd/coredump.conf /usr/lib/systemd/coredump.conf /etc/systemd/coredump.conf.d/*.conf /run/systemd/coredump.conf.d/*.conf /usr/local/lib/systemd/coredump.conf.d/*.conf /usr/lib/systemd/coredump.conf.d/*.conf These files configure the behavior of systemd-coredump8, a handler for core dumps invoked by the kernel. Whether systemd-coredump is used is determined by the kernel's kernel.core_pattern sysctl8 setting. See systemd-coredump8 and core5 pages for the details. All options are configured in the [Coredump] section: Storage= Controls where to store cores. One of none, external, and journal. When none, the core dumps may be logged (including the backtrace if possible), but not stored permanently. When external (the default), cores will be stored in /var/lib/systemd/coredump/. When journal, cores will be stored in the journal and rotated following normal journal rotation patterns. When cores are stored in the journal, they might be compressed following journal compression settings, see journald.conf5. When cores are stored externally, they will be compressed by default, see below. Note that in order to process a coredump (i.e. extract a stack trace) the core must be written to disk first. Thus, unless ProcessSizeMax= is set to 0 (see below), the core will be written to /var/lib/systemd/coredump/ either way (under a temporary filename, or even in an unlinked file), Storage= thus only controls whether to leave it there even after it was processed. Compress= Controls compression for external storage. Takes a boolean argument, which defaults to yes. ProcessSizeMax= The maximum size in bytes of a core which will be processed. Core dumps exceeding this size may be stored, but the stack trace will not be generated. Like other sizes in this same config file, the usual suffixes to the base of 1024 are allowed (B, K, M, G, T, P, and E). Defaults to 1G on 32-bit systems, 32G on 64-bit systems. Setting Storage=none and ProcessSizeMax=0 disables all coredump handling except for a log entry. EnterNamespace= For processes belonging to a PID namespace, controls whether systemd-coredump8 shall attempt to process core dumps on the host, using debug information from the file system hierarchy (i.e. the mount namespace) of the process that crashed. Access to the process' file system hierarchy might be necessary to generate a fully symbolized backtrace. If set to yes, systemd-coredump will obtain the tree of mounts from the crashing process' mount namespace and will try to generate the stack trace in host context using the debug information of binaries and libraries contained in the crashing process' hierarchy. Defaults to no, i.e. no attempt is made to acquire external debug information from the process' mount namespace, in order to maximize security. This option has no effect on processes that are part of the host's PID namespace. Note that the coredump of the namespaced process is still saved in /var/lib/systemd/coredump/ on the host even if EnterNamespace= is set to no (subject to Storage=). Note that EnterNamespace= only has an effect if a core dump is generated by a container whose unit does not have CoredumpReceive= enabled. Note that it's typically preferable to let containers and other namespace-based sandboxes process their own coredumps, if possible, for best security. This may be enabled on the container's unit via the CoredumpReceive= setting, see systemd.resource-control5 for details. ExternalSizeMax= JournalSizeMax= The maximum (compressed or uncompressed) size in bytes of a coredump to be saved in separate files on disk (default: 1G on 32-bit systems, 32G on 64-bit systems) or in the journal (default: 767M). Note that the journal service enforces a hard limit on journal log records of 767M, and will ignore larger submitted log records. Hence, JournalSizeMax= may be lowered relative to the default, but not increased. Unit suffixes are allowed just as in ProcessSizeMax=. ExternalSizeMax=infinity sets the core size to unlimited. MaxUse= KeepFree= Enforce limits on the disk space, specified in bytes, taken up by externally stored core dumps. Unit suffixes are allowed just as in ProcessSizeMax=. MaxUse= makes sure that old core dumps are removed as soon as the total disk space taken up by core dumps grows beyond this limit (defaults to 10% of the total disk size). KeepFree= controls how much disk space to keep free at least (defaults to 15% of the total disk size). Note that the disk space used by core dumps might temporarily exceed these limits while core dumps are processed. Note that old core dumps are also removed based on time via systemd-tmpfiles8. Set either value to 0 to turn off size-based cleanup. Use systemd-analyze cat-config systemd/coredump.conf to display the full config. systemd-journald.service8 coredumpctl1 systemd-tmpfiles8