abrt-ccpp 忽略 MaxCrashReportsSize 并创建一个巨大的转储 :(

Question

我的 abrt-ccpp 服务突然停止将转储限制在 10M 并创建了大量转储 - 我遗漏了什么？（我真的没有改变任何东西......）

我的转储文件夹：

sudo du -sh /home/tmp/abrt/*
12K     /home/tmp/abrt/ccpp-2016-10-07-01:22:40-1838
17G     /home/tmp/abrt/ccpp-2016-10-31-16:49:34-27695.new

服务状态：

service abrt-ccpp status
Redirecting to /bin/systemctl status  abrt-ccpp.service
abrt-ccpp.service - Install ABRT coredump hook
   Loaded: loaded (/usr/lib/systemd/system/abrt-ccpp.service; enabled)
   Active: active (exited) since Mon 2016-10-31 16:48:23 IST; 8min ago

service abrtd status
Redirecting to /bin/systemctl status  abrtd.service
abrtd.service - ABRT Automated Bug Reporting Tool
   Loaded: loaded (/usr/lib/systemd/system/abrtd.service; enabled)
   Active: active (running) since Mon 2016-10-31 16:48:22 IST; 8min ago

配置：

grep MaxCrash /etc/abrt/abrt.conf
MaxCrashReportsSize = 10

系统：

cat /etc/redhat-release
CentOS Linux release 7.1.1503 (Core)

我不断收到这些：

Nov  3 10:40:55 node-02 abrt-hook-ccpp: Saved core dump of pid 21337 (Linux/Release/Flow) to /home/tmp/abrt/ccpp-2016-11-03-10:39:33-21337 (6489010176 bytes)

Answer 1

从https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/sect-abrt-configuration-abrt.html：

一旦达到此处指定的配额，ABRT 将继续捕获问题，并且为了给新的崩溃转储腾出空间，它将删除最旧和最大的崩溃转储。

根据我自己的观察，我认为abrt即使最后一个核心转储大于限制，它也会存储。我认为限制仅决定它是否删除“旧”转储。