Debug "Segmentation fault (core dumped)" on a Linux server

A segmentation fault means a program tried to read or write memory it does not own, so the kernel stopped it. On servers, this often shows up as PHP-FPM children dying, 502 errors, or a command that prints Segmentation fault (core dumped). Here is how to find what crashed and why.

Before you start

• Root or sudo access over SSH.
• Know when the crash happens: one command, a web request, or at random.

Find the crash in the logs

sudo dmesg -T | grep -i segfault

A typical line:

php-fpm8.2[12345]: segfault at 0 ip 00007f... sp 00007ff... error 4 in opcache.so[7f...]

The part after in names the library that crashed, here opcache.so. That is often enough to find the cause. For PHP-FPM, the pool log also shows exited on signal 11 (SIGSEGV).

Common causes

• A PHP extension built for another PHP version, or a mismatched ionCube, Xdebug or OPcache. Disable the extension named in the log and test again.
• A JIT or OPcache bug. Try opcache.jit=off, then restart PHP-FPM.
• Mixed packages after a partial upgrade. Finish it with sudo apt full-upgrade or sudo dnf distro-sync.
• Infinite recursion in application code, which exhausts the stack.
• Faulty RAM is rare on a VPS. If many unrelated programs crash at random, contact support.

Capture a core dump

On systemd distributions, systemd-coredump stores crashes. List them:

coredumpctl list

If nothing is stored, install systemd-coredump (Debian/Ubuntu) and allow cores in the shell with ulimit -c unlimited. For PHP-FPM, also set rlimit_core = unlimited in the pool config.

Get a backtrace with gdb

sudo apt install gdb && coredumpctl gdb

At the (gdb) prompt, type bt. The top frames show the function and library that crashed. Install debug symbols (-dbgsym or -debuginfo packages) for readable names.

Fix and verify

1. Remove or update the module named in the backtrace.
2. Restart the service and reproduce the request or command.
3. Watch dmesg -Tw while you test, to confirm that no new segfaults appear.

If PHP-FPM workers keep dying, also check fix 502 Bad Gateway with PHP-FPM and manage PHP extensions.

FAQ

Is a segfault the same as running out of memory?

No. Out of memory kills a process with SIGKILL and logs the OOM killer in dmesg. A segfault is an invalid memory access (SIGSEGV), usually caused by a bug. See the OOM killer guide for memory problems.

Can a segfault happen on shared cPanel hosting?

Yes, but you cannot debug it with gdb there. Send the time and URL to support, and try switching the PHP version or disabling recently enabled extensions.

Where are core dump files stored?

With systemd-coredump, cores are stored in /var/lib/systemd/coredump/. Otherwise the kernel's core_pattern decides; check it with cat /proc/sys/kernel/core_pattern.