Symantec IGA

Enable unlimited core dumps for select uid /etc/security/limits.conf

  • 1.  Enable unlimited core dumps for select uid /etc/security/limits.conf

    Posted May 15, 2018 02:04 PM

    Team,

     

    Some notes state core dumps need to be enabled to isolate issues with the Linux releases of the Provisioning Server.

    Provisioning Servers on UNIX - CA Identity Manager - 14.0 - CA Technologies Documentation 

     

     

     

    The below process shows where to re-enable core dumps for the imps userID.

     

    Update note about disabling or enabled core dumps in /etc/security/limits.conf

     

     

     

     

    Example:  To disable ALL core dumps on a Linux server
    *   hard   core   0


    To enable core dumps ONLY for uid=imps (with unlimited size)
    imps   hard   core   unlimited

     

     

    Restart the system or re-issue the sysctl command(s)

     

    Example:

     

    # Enforce updates without reboot
    /sbin/sysctl -p
    /sbin/sysctl --system

     

     

     

     

    Cheers,

     

    Alan

     

     

     

    #### Script used for other updates to /etc/security/limits.con for IMPS service (and if using Oracle dB on Linux) ####

     

     

    #!/bin/bash
    #####################################################################################
    #
    # Update Linux Kernel Settings for Oracle XE 10g and CA IM IMPS
    #
    #####################################################################################
    # Oracle DB requires kernel.sem third value to be 100
    # Ref:  http://docs.oracle.com/cd/B28359_01/install.111/b32002/pre_install.htm#BABBBDGA
    #       http://www.oracle.com/technetwork/articles/smiley-11gr1-install-092791.html#kernel
    #       http://www.server-world.info/en/note?os=CentOS_6&p=oracle11g
    #       http://www.gnali.org/?p=44             Oracle strongly suggests to adjust the
    #         (rmem) default and maximum receive buffer size (SO_RCVBUF socket option) to 4MB and the
    #         (wmem) default and maximum send buffer size (SO_SNDBUF socket option) to 256KB.
    #
    #      kernel.shmall = 2097152
    #      kernel.shmmax = 536870912
    #      kernel.shmmni = 4096
    #      kernel.sem = 250 32000 100 128
    #      fs.file-max = 65536
    #      net.ipv4.ip_local_port_range = 1024 65000
    #      net.core.rmem_default=4194304
    #      net.core.rmem_max=4194304
    #      net.core.wmem_default=262144
    #      net.core.wmem_max=262144
    #
    ############## http://dbaora.com/install-oracle-11g-release-2-11-2-on-centos-linux-7/  ########
    #
    #      kernel.shmall = 1073741824
    #      kernel.shmmax = 4398046511104
    #      kernel.shmmni = 4096
    #      kernel.sem = 250 32000 100 128
    #      fs.file-max = 6815744
    #      fs.aio-max-nr = 1048576
    #      net.ipv4.ip_local_port_range = 9000 65500
    #      net.core.rmem_default = 262144
    #      net.core.rmem_max = 4194304
    #      net.core.wmem_default = 262144
    #      net.core.wmem_max = 1048586
    #
    #####################################################################################
    #
    # CA IMPS required kernel.sem fourth value (semmni) to be set to 260 (or higher)
    #     kernel.sem = 250 32000 32 260
    #
    #####################################################################################
    #
    # CA IMPS ECS requires:
    # IPC kernel parameter limits for Enterprise Common Services
    #
    #  msgmni=32   # max number of message queues
    #  semmni=256  # max number of semaphore arrays
    #  semmns=512  # max total number of semaphores
    #  semmnu=256  # max number of undo structures
    #  semume=128  # max undo structures per process
    #  shmmni=128  # max number of shared memory segments
    #  shmmin=4    # minimum size for shared memory segments
    #
    #  Ref: /opt/CA/media/iso/ca/iam_suite/r12-6-5/server/Provisioning/ProvisioningServer/linux/ecs-installation/bin/require.list
    #
    #####################################################################################
    #
    # CA SSO (Siteminder) Web Agent on Linux for Apache
    # Ref:  http://customerconnect.ca.com/cc/kbtech?docid=529712&searchID=TEC529712
    #
    #     kernel.shmmax=2147483648
    #     kernel.shmmni=4096
    #
    #####################################################################################
    #
    #  RHEL 6.7 Default Values - Minimal ISO  (/sbin/sysctl -a )
    #
    #      kernel.shmmax = 68719476736    [Compare: CentOS7 is 268435456]
    #      kernel.shmall = 4294967296     [Compare: CentOS7 is 4294967295]
    #      kernel.shmmni = 4096           [Compare: Same as CentOS7]
    #      kernel.sem = 250 32000 32 128  (SEMMSL, SEMMNS, SEMOPM, and SEMMNI) [Compare: Same as CentOS7]
    #      fs.file-max = 186632           [Compare: CentOS7 is 792850]
    #      fs.aio-max-nr = 65536          [Compare: Same as CentOS7]
    #      net.ipv4.ip_local_port_range = 32768 61000   [Compare: Same as CentOS7]
    #      net.core.rmem_default = 124928               [Compare: CentOS7 is 212992]
    #      net.core.rmem_max = 124928                   [Compare: CentOS7 is 212992]
    #      net.core.wmem_default = 124928               [Compare: CentOS7 is 212992]
    #      net.core.wmem_max = 124928                   [Compare: CentOS7 is 212992]
    #      kernel.panic = 0                             [Compare: Same as CentOS7]
    #
    #
    #######################################################################################
    BACKUPDATE=`date +%Y%m%d_%H%M%S_%N`
    MEDIAFOLDER=/opt/CA/media

     

    echo "######################################################################################"
    echo "### Current kernel override tokens in /etc/sysctl.conf file                        ###"
    echo "### On minimal ISO CentOS image, this file has no override tokens                  ###"
    cat /etc/sysctl.conf

     


    echo "#####################################################################################"
    echo "### Backup current/default kernel value strings in  /etc/sysctl.conf file         ###"
    /sbin/sysctl -a >  $MEDIAFOLDER/sysctl_-a.conf.prior.$BACKUPDATE
    /sbin/sysctl -a >  /etc/sysctl_-a.prior.$BACKUPDATE
    cp -r /etc/sysctl.conf /etc/sysctl.conf.$BACKUPDATE

     


    echo "#####################################################################################"
    echo "### Update kernel default value strings by adding entries to /etc/sysctl.conf file ###"

     


    cat << 'EOF' >> /etc/sysctl.conf
    ### Added the below values to meet guidelines for ###
    ### Oracle DB XE 11g, CA IMPS, & CA SSO WebAgent  ###
    kernel.shmall = 1073741824
    kernel.shmmax = 4398046511104
    kernel.shmmni = 4096
    kernel.sem = 250 32000 100 320
    fs.file-max = 6815744
    fs.aio-max-nr = 1048576
    net.ipv4.ip_local_port_range = 1024 65500
    net.core.rmem_default = 4194304
    net.core.rmem_max = 4194304
    net.core.wmem_default = 262144
    net.core.wmem_max = 262144
    kernel.panic = 10
    EOF

     


    echo "#####################################################################################"
    # Enforce updates without reboot
    /sbin/sysctl -p
    /sbin/sysctl --system

     

    echo "#####################################################################################"
    echo "### cat /etc/sysctl.conf ###"
    cat /etc/sysctl.conf

     


    echo "#####################################################################################"
    echo "### Update ulimits hard and soft for Oracle and IMPS shell accounts ###"
    echo "### Address ulimit hard core limit for root                         ###"
    cp -r /etc/security/limits.conf /etc/security/limits.conf.$BACKUPDATE
    cat << EOF >> /etc/security/limits.conf
    imps   hard  nofile 4096
    imps   soft  nproc  4096
    oracle soft  nproc  2047
    oracle hard  nproc  16384
    oracle soft  nofile 1024
    oracle hard  nofile 65536
    *      soft  core   unlimited
    EOF

     


    echo "#####################################################################################"
    echo "### Update /etc/profile for ulimit settings for Oracle $ IMPS shell accounts      ###"
    cp -r /etc/profile /etc/profile.oracle.$BACKUPDATE
    cat << EOF >> /etc/profile
    ################# ORACLE ####################
    ################# ORACLE ####################
    ################# ORACLE ####################
    if [ \$USER = "oracle" ]; then
        if [ \$SHELL = "/bin/ksh" ]; then
            ulimit -n 65536
        else
            ulimit -u 16384 -n 65536
        fi
        umask 022
    fi
    EOF

     

     

     

    echo "#####################################################################################"
    # Ensure "ulimit -c 0" is not declared .bash_profile   && Enable Globally enable Core Dumps in limits.conf
    echo "#####################################################################################"
    echo "###  cat /etc/security/limits.conf  ###"
    cat /etc/security/limits.conf

     

    echo ""
    echo ""
    echo " Three files were updated:   "
    echo ""
    echo " /etc/security/limits.conf  for ulimit for Oracle and IMPS"
    echo " /etc/profile    for  interactive Oracle XE DB ulimits upon login with Oracle account"
    echo " /etc/sysctl.conf    for kernel settings for Oracle, IMPS, and SiteMinder (SSO)"
    echo ""
    echo " Note:  Select CA solutions will create a /etc/profile.CA file that will"
    echo "        be called from /etc/profile for every shell account "
    echo ""
    echo ""