Zorp uses systemd-coredump to capture application firewall crashes. systemd-coredump provides the coredumpctl command line tool to manage core dumps. It creates compressed core dump files under /var/lib/systemd/coredump directory, the related logs into the journal, and the syslog-ng /var/log/messages file.

The coredumpctl list presents a summary about the core dump events. The coredump dump <PID> -o /path/to/uncompressed/coredump command line extracts a core dump to a given file referenced by the process's PID.

By default, systemd-coredump uses maximum 10% of the underlying storage of /var/lib/systemd/coredump directory, but leaves at least the 15% free space. The preferred setting ensures more than 200 GByte storage under the filesystem holding the /var/lib/systemd/coredump directory for the host. For smaller partitions it is recommended to customize systemd-coredump settings with the provided FreeText template and to define more space than 10% for the core dump usage and more than 15% free space with the help of the MaxUse= and KeepFree= parameters.