ulimit not limiting core file size

[praveen455]

Hi ,

-->a) I want to limit the core file size but linux is not limiting the core file size to specified size...
if i limit core file size using(ulimit -c) (keep ulimit -f unlimited)

ulimit -c 10, then core file generated is of 12288 bytes
ulimit -c 20, then core file generated is of 20480 bytes
ulimit -c 30, then core file genearted is 0f 32768 bytes

i dont know what is the funda or on what fators does ulimit limits core file size
if it limits , for ulimit -c 10 , it should limit to 10*1024 bytes i.e 10240 bytes
but core file size is crossing 10240 bytes, and the core size generated is of 12288 bytes.

for ulimit -c 20 , core file size is 20480 , which is again 1024*20
again for ulimit -c 30 , core file size is 32768

[root@localhost three]# ls -la /tmp/corefiles/
total 124
drwxr-xr-x 2 root root 4096 2008-06-28 15:24 .
drwxrwxrwt 53 root root 20480 2008-06-28 15:08 ..
-rw------- 1 root root 12288 2008-06-27 19:34 core.31832
-rw------- 1 root root 1024 2008-06-28 15:18 core.3779
-rw------- 1 root root 1260 2008-06-28 15:18 core.3784
-rw------- 1 root root 20480 2008-06-28 15:23 core.3798
-rw------- 1 root root 32768 2008-06-28 15:24 core.3807


-->b) If we go for ulimit -f option(which limits core file size)
(keeping ulimit -c unlimited)

ulimit -f 1 then core file generated is 1024 bytes
ulimit -f 2 then core file generated is 1260 bytes
ulimit -f 3 then core file generated is 1260 bytes
ulimit -f 5 then core file generated is 5120 bytes
ulimit -f 10 then core file generated is 10240 bytes

now for ulimit -f 1, core file size is limiting to 1024 bytes,
for ulimit -f 2, core file size is limiting to 1260 bytes,but it should actually limit to 2048 bytes?

i am not able to come to a solution please help me

thanks in advance,
praveen
kpraveen455@gmail.com

[wje_lf]

This is interesting.

I ran an experiment with a program which outputs lots of data to a file. The size of that file ended up being controlled by the ulimit -f limit, down to the exact byte. If the file had not yet reached the limit and the program tried to write out too many bytes, only the permitted number of bytes were written out, and the program was notified of the number of bytes that were written. If the file had already reached the limit and the program tried to write out any more bytes, the process received the SIGXFSZ signal. By default, that terminates the process with a core dump, but a program can catch or ignore that signal if it wants.

The size of a core file, though, is something else. As you've discovered and my experiments confirmed, ulimit -c and ulimit -f do place limits on the size of the core file, but those limits are only approximate.

Why does it work exactly for data files, but only approximately for core files? I'm going to make a guess here.

The ulimit facility is intended to place limits on what can happen in a particular user process (and in its child processes). But a core dump is not formed in the user process itself; it's formed in the kernel.

In particular, there's room in the Linux kernel for various kinds of executable object files. The two that I'm aware of are the old a.out format and the newer ELF format. Each of these (as well as any others that may exist) is implemented as part of the kernel, and provides a function which the kernel is to call if a core dump is to be provided, since the core dump happens differently for each executable object file format.

Caution: the remainder of this post is only a guess.

Since the limits are only applied in user space, these core dump functions must keep an eye on the ulimit -c and ulimit -f limits themselves. My guess is that the core dump function for ELF uses the limits as rough guidelines, as ways to keep the user from running out of disk space. I guess further that the implementer of ELF on Linux decided that it would complicate the code too much to respect the limits down to the exact byte.

Just a guess.