Repository navigation
feat: Enable coredump collection and processing for OrioleDB - #2459
Merged
Merged
Conversation
This comment has been minimized.
This comment has been minimized.
PostgreSQL Extension Dependency Analysis: PR #2459
SummaryNo extensions had dependencies with MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Extension DependenciesPostgreSQL 17 Extension DependenciesOrioleDB 17 Extension Dependencies |
PostgreSQL Package Dependency Analysis: PR #2459
SummaryNo packages had MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Dependency ChangesExtracting PostgreSQL 15 dependencies...
Runtime Closure Size
Raw Dependency ClosurePostgreSQL 17 Dependency ChangesExtracting PostgreSQL 17 dependencies...
Runtime Closure Size
Raw Dependency Closure |
pgnickb
force-pushed
the
nickb/orioledb_coredump
branch
from
September 23, 2026 07:30
0ac3a3f to
e3655f2
Compare
mmlb
reviewed
Sep 23, 2026
pgnickb
force-pushed
the
nickb/orioledb_coredump
branch
2 times, most recently
from
September 29, 2026 14:24
59f9aec to
e95cd1c
Compare
mmlb
reviewed
Sep 29, 2026
pgnickb
force-pushed
the
nickb/orioledb_coredump
branch
from
September 30, 2026 10:04
e95cd1c to
002e207
Compare
mmlb
reviewed
Sep 30, 2026
pgnickb
force-pushed
the
nickb/orioledb_coredump
branch
from
September 30, 2026 14:53
5de0e12 to
7923805
Compare
mmlb
requested changes
Sep 30, 2026
This comment has been minimized.
This comment has been minimized.
pgnickb
force-pushed
the
nickb/orioledb_coredump
branch
from
September 30, 2026 23:39
a41950c to
2db60a0
Compare
Scope core capture to postgresql.service only: LimitCORE=infinity via a drop-in, and a machine-wide DefaultLimitCORE=0 so no other service is affected. Also set fs.suid_dumpable=2, without which the AppArmor-confined postmaster's exec is treated as a kernel "secure exec" and made entirely non-dumpable, so no core is produced at all regardless of LimitCORE. Gated behind a new is_psql_oriole fact in setup-postgres.yml (OrioleDB only). Add the OrioleDB-only processing pipeline: a systemd path unit (with a timer fallback) that runs process-orioledb-coredumps.sh whenever a new core appears. The script filters to postgres-owned cores, extracts a GDB backtrace/lock-state bundle (cmds.gdb, matching orioledb/ci's own debugging script) into a redacted diagnostic bundle, then deletes the raw core, retrying/quarantining on repeated failure. Also sets the kernel's default coredump_filter to 0x31 (excluding shared_buffers) via a GRUB parameter, so it applies from every process's first fork onward. This is what actually fixes the filter: a per-unit CoredumpFilter= directive on postgresql.service was tried first but gets silently reset by AppArmor's unconfined->confined exec transition.
pgnickb
force-pushed
the
nickb/orioledb_coredump
branch
from
September 30, 2026 23:40
2db60a0 to
9a3aa4b
Compare
mmlb
approved these changes
Oct 1, 2026
mmlb
left a comment
mmlb
left a comment
Collaborator
There was a problem hiding this comment.
Approving but will need some follow up adding new uid/gid to audit-files.
Contributor
Author
Do you have a plan on how to do this? Since it is a conditional service we're installing, how would you like to approach the check? |
Collaborator
oh good question... I did not make that connect :P I don't want to dupe the all the directories for orioledb :D Let me think on that, ansible-lint is sort of saving us a bit here by requiring uid/gids but there's nothing ensuring any unexpected users/groups pop up unexpectedly. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
feature: collect and process coredumps for orioledb instances.
What is the current behavior?
coredumpts arent' collected
What is the new behavior?
upon crash a coredump is written, then it is processed into a bundle including:
Additional context
this work is critical for orioledb team as we're about to start beta and debugging any future crashes without coredump is going to be very problematic.
One important caveat: currently only
postgresdebug symbols are shipped. Shippingorioledbdebug symbols is outside of the scope of this PR.