Enable Core Dumps for FileWave Booster Crashes

Collect a Booster core dump on Debian

Temporary diagnostic configuration. Enable core dumps only while troubleshooting with FileWave Technical Support. Core files can be large and may contain sensitive process data. Revert the changes after the required dump is collected.

Step-by-step guide

1. Edit the Booster supervisor configuration:
   sudo vi /usr/local/etc/filewave/supervisor/supervisord-booster.conf

2. Uncomment this line:
   command=/bin/bash -c "ulimit -c unlimited && /usr/local/sbin/fwbooster

3. Restart the FileWave Booster:

   sudo /etc/init.d/fw-booster restart

4. Edit the kernel settings file:

   sudo vi /etc/sysctl.conf

5. Add the lines below:

   kernel.core_uses_pid = 1

   kernel.core_pattern = /tmp/core-%e-%s-%u-%g-%p-%t

   fs.suid_dumpable = 2

6. Reload the settings in /etc/sysctl.conf:

   sysctl -p
   

7. Open the limits configuration file:
   sudo vi /etc/security/limits.conf
   

8. Add the following lines to set unlimited core dump sizes for all users:

   * soft core unlimited
   

   * hard core unlimited

9. Save and close the file. Note: Changes take effect upon the next login. You may need to restart the system or re-login for the settings to apply.

Controlled test.
Confirm that /tmp has enough free space, identify the active fwbooster process with ps ax | grep fwbooster, and replace the sample PID before running:
kill -6 3014

This interrupts the Booster process. Verify that a file similar to core-fwbooster-6-0-0-8440-1509016449 appears under /tmp, then follow the secure transfer instructions from FileWave Technical Support.

Revert the diagnostic configuration

1. Re-comment the changed command= line in /usr/local/etc/filewave/supervisor/supervisord-booster.conf.
2. Remove the three core-dump settings added to /etc/sysctl.conf, then run sudo sysctl -p.
3. Remove the two * core unlimited entries added to /etc/security/limits.conf.
4. Restart the FileWave Booster and remove the diagnostic core file after FileWave Technical Support confirms it is no longer needed.