Finding the source of a sigill

[Dan Nelson]

In the last episode (Jan 26), Paul Schmehl said:
> --On Wednesday, January 26, 2005 10:33:51 AM -0600 Dan Nelson 
> <dnelson at allantgroup.com> wrote:
> >In the last episode (Jan 26), Paul Schmehl said:
> >>I found this in the messages log when snort died:
> >>
> >>Jan 26 03:19:34 buttercup2 /kernel: pid 53186 (snort), uid 0: exited on signal 4
> >>
> >>There was no core dump.  Is there a way to figure out what the
> >>cause of the sigill was?
> >
> >An illegal instruction :)  No way to find out any more without a
> >core file.
> 
> Any way of knowing why sigill didn't produce a core file?  (It does when 
> make fails.)

Snort might have disabled it, or it might have been disabled by a
startup script.  Try adding "limit -c unlimited" to the snort startup
script.  From the log message, it's running as root so it's not like it
couldn't write the corefile.

-- 
	Dan Nelson
	dnelson at allantgroup.com