Trouble getting a core dump from clamd

[Chuck Swiger]

Hi--

On Jan 19, 2010, at 10:04 AM, Doug Poland wrote:
> No joy.
> 
> # sysctl kern.corefile=/var/crash/clamd.core
> # /usr/local/etc/rc.d/clamav-clamd start
>  Starting clamav_clamd.
>  Segmentation fault
> # ll /var/crash
>  total 2
>  -rw-r--r--  1 root  wheel  5 Apr 10  2005 minfree

Please see "man 5 core"; in particular, clamd changes userid:

     By default, a process that changes user or group credentials whether real
     or effective will not create a corefile.  This behaviour can be changed
     to generate a core dump by setting the sysctl(8) variable
     kern.sugid_coredump to 1.

...so you will need to toggle that sysctl also.  I'd suggest doing something more like:

mkdir /cores
chmod 1777 /cores
sysctl kern.sugid_coredump=1
sysctl kern.corefile=/cores/%N.%P.core

...but adjust the path to be under /var or /usr if free diskspace makes doing so necessary.

Regards,
-- 
-Chuck