/var/crash/* disappear after reboot

[Vivek Goyal]

On Tue, Apr 10, 2012 at 11:17:37AM +0200, Michal Toman wrote:
> On 2012/10/04 09:48, Cong Wang  wrote:
> >On 04/09/2012 05:32 PM, Dave Young wrote:
> >>On 04/09/2012 04:55 PM, Nikola Pajkovsky wrote:
> >>
> >>From kdump side of view, the vmcore should be there instead of being
> >>deleted, It's the default behaviour. Could the abrt keep them?
> >>
> >>I can not think out why it will delete them if user/customer intend to
> >>capture and save them vmcore there.
> >>
> >
> >Me neither. vmcore should be stored for further kernel debugging.
> 
> From kdump side of view nothing changes. It really writes the vmcore
> to /var/crash.
> 
> The "disappearing" happens after reboot, when abrt-vmcore service
> processes it. The vmcore itself is not deleted, but moved to
> /var/spool/abrt/vmcore-{whatever}/vmcore so that it can be processed
> like any other ABRT problem. You can still access it there, nothing
> is lost. In addition, ABRT provides tools to automatically install
> appropriate kernel debuginfo, extract the oops message and report it
> to Bugzilla.
> 
> If you still want the old behavior, you can simply disable the
> abrt-vmcore service and ABRT will not touch the vmcore at all.
> 

I think vmcore should not be moved by ABRT. At max they can create
a soft link to vmcore present in /var/crash.

I am surprised that abrt guys did not even communicate this decision
to kdump folks and just went ahead and decided to automatically move
vmcore.

In rhel history kernel vmcore has always been present in /var/crash
by default. Kdump allows user to change the location and save it either
in a different directory, different filesystem or on a different machine
over network etc. So first of all assuming that after system crash
vmcore is present in /var/crash is broken.

Secondly, user might have mounted a separate disk on /var/crash
which has sufficient space to store vmcores. Trying to move it to /
var/spool/ might fail due to lack of space.

Thirdly, it breaks the existing behavior. So abrt maintainers, please
change this behavior. Don't break thinkgs by default. I think hardcoding
the logic to look into /var/crash/ for vmcores or creating a soft
link should work for you. Even if does not work for whatever reason,
please disable abrt-vmcore service by default. This is completely
unexpected change of behavior.

Thanks
Vivek