RHEL 6 Deployment - 21.7. Configuring Centralized Crash Collection

Red Hat Enterprise Linux 9 Essentials Book now available.

Purchase a copy of Red Hat Enterprise Linux 9 (RHEL 9) Essentials

Red Hat Enterprise Linux 9 Essentials Print and eBook (PDF) editions contain 34 chapters and 298 pages

21.7. Configuring Centralized Crash Collection

You can set up ABRT so that crash reports are collected from multiple systems and sent to a dedicated system for further processing. This is useful when an administrator does not want to log into hundreds of systems and manually check for crashes found by ABRT. In order to use this method, you need to install the abrt-plugin-reportuploader plugin (yum install abrt-plugin-reportuploader).

The steps to configure ABRT's centralized crash collection are:

Complete the following steps on a dedicated system ("server system"):
- Create a directory to which you want the crash reports to be uploaded to. Usually, /var/spool/abrt-upload/ is used (the rest of the document assumes you are using /var/spool/abrt-upload/). Make sure this directory is writable by the abrt user.
  
  Note
  
  When the abrt-desktop package is installed, it creates a new system user and and a group, both named abrt. This user is used by the abrtd daemon for various things, for example, as the owner:group of /var/spool/abrt/* directories.
- In the /etc/abrt/abrt.conf configuration file, set the WatchCrashdumpArchiveDir directive to the following:
```
WatchCrashdumpArchiveDir = /var/spool/abrt-upload/
```
- Determine your preferred upload mechanism; for example, FTP or SCP. For more information on how to configure SCP, refer to Section 9.3.2, “Using the scp Utility”.
  
  For security reasons, make sure that uploads can only be performed by a specific user and with a password. The rest of the document assumes that the username used for uploads is USERNAME and the password is PASSWORD. If you do not already have a suitable username which can be used to perform uploads under, you may use the abrt user which already exists on every system where ABRT is installed.
  
  It is advisable to check whether your upload method works. For more information, refer to Section 21.7.2, “Testing the Upload Method”.
- It is advisable to check and modify the following parameters if needed:
  - The MaxCrashReportsSize directive (in /etc/abrt/abrt.conf) needs to be set to a larger value if the expected volume of crash data is larger than the default 1000 MB.
  - The ProcessUnpackaged directive (in /etc/abrt/abrt.conf) needs to be set to yes and the BacktraceRemotes (in /etc/abrt/plugins/CCpp.conf) needs to be set to no if the client system and the server system have significantly different sets of installed packages.
Complete the following steps on every client system which will use the central management method:
- Modify the /etc/abrt/plugins/ReportUploader.conf configuration file so that the ReportUploader plugin knows where to copy the saved crash reports in the following way:
```
Enabled = yes
Upload = yes
URL = ftp://USERNAME:PASSWORD@SERVERNAME/var/spool/abrt-upload/
```
- To automatically send the crash reports to the server system immediately after the crash occurs, is detected, and saved, set the [ ActionsAndReporters ] directive in the /etc/abrt/abrt.conf configuration file to the following:
```
ActionsAndReporters = ReportUploader
```
- # Alternatively, if user interaction is required before the crash dump is sent to the server system, set the ReportUploader to be a reporter plugin for a specific crash type in the [ AnalyzerActionsAndReporters ] section of the /etc/abrt/abrt.conf configuration file. The user will be required to run abrt-cli or abrt-gui and instruct the abrtd daemon to report the crash and send it to the server system. For example, if you want all crash types to use this method, edit the [ AnalyzerActionsAndReporters ] section in your /etc/abrt/abrt.conf configuration file in the following way:
```
Kerneloops = ReportUploader
CCpp = ReportUploader
Python = ReportUploader
```

21.7.1. Testing ABRT's Crash Detection

After completing all the steps of the configuration process, the basic setup is finished. To test that this setup works properly use the kill -s SEGV PID command to terminate a process on a client system. For example, start a sleep process and terminate it with the kill command in the following way:

~]$ sleep 100 &
[1] 2823
~]$ kill -s SEGV 2823

ABRT should detect a crash shortly after executing the kill command. Check that the crash was detected by ABRT on the client system (this can be checked by examining the appropriate syslog file, by running the abrt-cli --list --full command, or by examining the crash dump created in the /var/spool/abrt directory), copied to the server system, unpacked on the server system and can be seen and acted upon using abrt-cli or abrt-gui on the server system.

21.7. Configuring Centralized Crash Collection

Note

21.7.1. Testing ABRT's Crash Detection