Enabling Core Dumps for Apache (mod_php)

When PHP crashes unexpectedly, a core dump captures the exact memory state of the process at the moment it died. Monarx engineering uses these files to produce a backtrace and pinpoint the root cause. This guide covers servers where PHP runs as an Apache module (mod_php / DSO) — common on cPanel, traditional LAMP stacks, and other non‑Nginx setups.

Which guide do I need?

PHP runs inside Apache (mod_php) → use this guide. A PHP segfault crashes the Apache worker, so Apache must be configured to dump core.

Apache + PHP‑FPM (mod_proxy_fcgi) → use Enabling Core Dumps for PHP‑FPM. The crash happens in the FPM pool, not in Apache.

LiteSpeed / OpenLiteSpeed (lsphp) → use Enabling Core Dumps for LiteSpeed.

Check which one you have:

apachectl -M 2>/dev/null | grep -E 'php|proxy_fcgi'

php_module (or php7_module / php8_module) means mod_php — continue below.
proxy_fcgi_module with no php_module means you're on PHP‑FPM.

Throughout this guide, substitute your distribution's Apache service name and run user:

Distro / Panel	Service	Run user	Config dir
Debian / Ubuntu	`apache2`	`www-data`	`/etc/apache2/`
RHEL / Alma / Rocky	`httpd`	`apache`	`/etc/httpd/`
cPanel (EasyApache 4)	`httpd`	`nobody`	`/etc/apache2/`

1. Tell Apache where to write core files

Apache changes into its CoreDumpDirectory before dumping. Add this directive to your main Apache config (/etc/apache2/apache2.conf, /etc/httpd/conf/httpd.conf, or a cPanel include — see the note below):

CoreDumpDirectory /var/log/apache2/cores

⚠️ cPanel: Do not edit the generated httpd.conf directly — it is overwritten. Put the directive in an include file instead:

/etc/apache2/conf.d/includes/pre_main_global.conf

then rebuild and restart with /scripts/rebuildhttpdconf && systemctl restart httpd.

2. Raise the core size limit for the Apache service

On systemd systems the service caps the core size at 0 by default. Create an override:

systemctl edit apache2.service or systemctl edit httpd.service

Add:

[Service]
LimitCORE=infinity

Then reload systemd and restart Apache:

systemctl daemon-reload
systemctl restart apache2

or:

systemctl restart httpd

3. Set the kernel core pattern

Define where the kernel writes cores and how they're named. Add to /etc/sysctl.conf:

kernel.core_pattern = /var/log/apache2/cores/core-%e.%p.%h.%t

The placeholders expand to %e executable name, %p PID, %h hostname, and %t timestamp. Apply it without rebooting:

sysctl -p

Precedence note: When kernel.core_pattern is an absolute path (as above), the kernel writes there directly and CoreDumpDirectory is used only as a fallback for relative patterns or suEXEC children. Setting both — as in steps 1 and 3 — covers every MPM and suEXEC configuration.

4. Create the dump directory with the right permissions

The directory must be writable by the user Apache runs as:

mkdir -p /var/log/apache2/cores
chown www-data:www-data /var/log/apache2/cores # use apache:apache or nobody:nobody to match your run user
chmod 1777 /var/log/apache2/cores

⚠️ SELinux (RHEL / Alma / Rocky / cPanel): if SELinux is enforcing, also allow Apache to write there:

semanage fcontext -a -t httpd_var_run_t "/var/log/apache2/cores(/.*)?"
restorecon -Rv /var/log/apache2/cores

5. Test that core dumps are generated

Find a running Apache worker and send it SIGSEGV (signal 11). The worker will crash and respawn — no lasting impact:

ps aux | grep -E 'apache2|httpd' | grep -v grep
kill -11 <PID>

Confirm a core file appeared:

ls -lh /var/log/apache2/cores/

You should see a file like core-apache2.12345.web01.1719600000. If nothing appears, re‑check steps 2–4 (most often LimitCORE was not reloaded, or the directory is not writable by the Apache run user).

Submitting a core dump to Monarx

Core files can be large — compress before sending:

gzip /var/log/apache2/cores/core-apache2.12345.web01.1719600000

Send the compressed file to support@monarx.com or via the dashboard chat, and include:

The PHP version (php -v)
The operating system / panel (e.g. cPanel + AlmaLinux 9)
Whether PHP runs as mod_php (from the apachectl -M check above)

Monarx engineering will run a backtrace analysis, identify the root cause, and recommend a fix.