]>
Commit | Line | Data |
---|---|---|
b78e3a80 | 1 | .\" Copyright (c) 2006, 2008 by Michael Kerrisk <mtk.manpages@gmail.com> |
0be6f5cc | 2 | .\" |
5fbde956 | 3 | .\" SPDX-License-Identifier: Linux-man-pages-copyleft |
0be6f5cc | 4 | .\" |
4c1c5274 | 5 | .TH core 5 (date) "Linux man-pages (unreleased)" |
0be6f5cc MK |
6 | .SH NAME |
7 | core \- core dump file | |
8 | .SH DESCRIPTION | |
c13182ef | 9 | The default action of certain signals is to cause a process to terminate |
0be6f5cc MK |
10 | and produce a |
11 | .IR "core dump file" , | |
b665474b | 12 | a file containing an image of the process's memory at |
0be6f5cc | 13 | the time of termination. |
78890124 MK |
14 | This image can be used in a debugger (e.g., |
15 | .BR gdb (1)) | |
16 | to inspect the state of the program at the time that it terminated. | |
0be6f5cc MK |
17 | A list of the signals which cause a process to dump core can be found in |
18 | .BR signal (7). | |
c6d039a3 | 19 | .P |
53cd945e | 20 | A process can set its soft |
0daa9e92 | 21 | .B RLIMIT_CORE |
c13182ef | 22 | resource limit to place an upper limit on the size of the core dump file |
0be6f5cc MK |
23 | that will be produced if it receives a "core dump" signal; see |
24 | .BR getrlimit (2) | |
25 | for details. | |
c6d039a3 | 26 | .P |
c13182ef | 27 | There are various circumstances in which a core dump file is |
0be6f5cc | 28 | not produced: |
cdede5cd | 29 | .IP \[bu] 3 |
67ed0e4b | 30 | The process does not have permission to write the core file. |
91aabea5 | 31 | (By default, the core file is called |
1ae6b2c7 | 32 | .I core |
ab0f60c6 MK |
33 | or |
34 | .IR core.pid , | |
35 | where | |
36 | .I pid | |
37 | is the ID of the process that dumped core, | |
c13182ef | 38 | and is created in the current working directory. |
67ed0e4b | 39 | See below for details on naming.) |
a23d8efa | 40 | Writing the core file fails if the directory in which |
b665474b | 41 | it is to be created is not writable, |
c13182ef | 42 | or if a file with the same name exists and |
67ed0e4b | 43 | is not writable |
c13182ef | 44 | or is not a regular file |
67ed0e4b | 45 | (e.g., it is a directory or a symbolic link). |
cdede5cd | 46 | .IP \[bu] |
c13182ef MK |
47 | A (writable, regular) file with the same name as would be used for the |
48 | core dump already exists, but there is more than one hard link to that | |
10cd859a | 49 | file. |
cdede5cd | 50 | .IP \[bu] |
9ee4a2b6 | 51 | The filesystem where the core dump file would be created is full; |
972a8ec7 | 52 | or has run out of inodes; or is mounted read-only; |
9ee4a2b6 | 53 | or the user has reached their quota for the filesystem. |
cdede5cd | 54 | .IP \[bu] |
c13182ef | 55 | The directory in which the core dump file is to be created does |
67ed0e4b | 56 | not exist. |
cdede5cd | 57 | .IP \[bu] |
78890124 | 58 | The |
0be6f5cc | 59 | .B RLIMIT_CORE |
78890124 | 60 | (core file size) or |
0be6f5cc | 61 | .B RLIMIT_FSIZE |
78890124 MK |
62 | (file size) resource limits for the process are set to zero; see |
63 | .BR getrlimit (2) | |
64 | and the documentation of the shell's | |
65 | .I ulimit | |
66 | command | |
67 | .RI ( limit | |
68 | in | |
69 | .BR csh (1)). | |
0354e338 AC |
70 | However, |
71 | .B RLIMIT_CORE | |
72 | will be ignored if the system is configured to pipe core dumps to a program. | |
cdede5cd | 73 | .IP \[bu] |
c13182ef | 74 | The binary being executed by the process does not have read |
0be6f5cc | 75 | permission enabled. |
2f0e61ae MK |
76 | (This is a security measure to |
77 | ensure that an executable whose contents are not readable | |
36546c38 | 78 | does not produce a\[em]possibly readable\[em]core dump containing |
2f0e61ae | 79 | an image of the executable.) |
cdede5cd | 80 | .IP \[bu] |
0be6f5cc | 81 | The process is executing a set-user-ID (set-group-ID) program |
c13182ef | 82 | that is owned by a user (group) other than the real user (group) |
60a119dd MK |
83 | ID of the process, |
84 | or the process is executing a program that has file capabilities (see | |
85 | .BR capabilities (7)). | |
0be6f5cc MK |
86 | (However, see the description of the |
87 | .BR prctl (2) | |
88 | .B PR_SET_DUMPABLE | |
89 | operation, and the description of the | |
90 | .I /proc/sys/fs/suid_dumpable | |
14523015 MK |
91 | .\" FIXME . Perhaps relocate discussion of /proc/sys/fs/suid_dumpable |
92 | .\" and PR_SET_DUMPABLE to this page? | |
0be6f5cc MK |
93 | file in |
94 | .BR proc (5).) | |
cdede5cd | 95 | .IP \[bu] |
6c3d8859 MK |
96 | .I /proc/sys/kernel/core_pattern |
97 | is empty and | |
98 | .I /proc/sys/kernel/core_uses_pid | |
99 | contains the value 0. | |
100 | (These files are described below.) | |
101 | Note that if | |
102 | .I /proc/sys/kernel/core_pattern | |
103 | is empty and | |
104 | .I /proc/sys/kernel/core_uses_pid | |
105 | contains the value 1, | |
106 | core dump files will have names of the form | |
107 | .IR .pid , | |
108 | and such files are hidden unless one uses the | |
109 | .BR ls (1) | |
4818bee5 | 110 | .I \-a |
6c3d8859 | 111 | option. |
cdede5cd | 112 | .IP \[bu] |
d298e17f MK |
113 | (Since Linux 3.7) |
114 | .\" commit 046d662f481830e652ac34cd112249adde16452a | |
115 | The kernel was configured without the | |
1ae6b2c7 | 116 | .B CONFIG_COREDUMP |
d298e17f | 117 | option. |
c6d039a3 | 118 | .P |
0ac3f06f MK |
119 | In addition, |
120 | a core dump may exclude part of the address space of the process if the | |
121 | .BR madvise (2) | |
122 | .B MADV_DONTDUMP | |
123 | flag was employed. | |
c6d039a3 | 124 | .P |
03c87136 MK |
125 | On systems that employ |
126 | .BR systemd (1) | |
127 | as the | |
128 | .I init | |
129 | framework, core dumps may instead be placed in a location determined by | |
130 | .BR systemd (1). | |
131 | See below for further details. | |
132 | .\" | |
0be6f5cc | 133 | .SS Naming of core dump files |
c13182ef | 134 | By default, a core dump file is named |
0be6f5cc | 135 | .IR core , |
c13182ef | 136 | but the |
0be6f5cc | 137 | .I /proc/sys/kernel/core_pattern |
b78e3a80 | 138 | file (since Linux 2.6 and 2.4.21) |
0be6f5cc MK |
139 | can be set to define a template that is used to name core dump files. |
140 | The template can contain % specifiers which are substituted | |
141 | by the following values when a core file is created: | |
c6d039a3 | 142 | .P |
b78e3a80 MK |
143 | .RS 4 |
144 | .PD 0 | |
145 | .TP 4 | |
146 | %% | |
6a7093c3 | 147 | A single % character. |
b78e3a80 | 148 | .TP |
b9ed1fbb | 149 | %c |
6a7093c3 | 150 | Core file size soft resource limit of crashing process (since Linux 2.6.24). |
b78e3a80 | 151 | .TP |
23ed8402 | 152 | %d |
fd9c713b | 153 | .\" Added in git commit 12a2b4b2241e318b4f6df31228e4272d2c2968a1 |
36546c38 | 154 | Dump mode\[em]same as value returned by |
fd9c713b MK |
155 | .BR prctl (2) |
156 | .B PR_GET_DUMPABLE | |
6a7093c3 | 157 | (since Linux 3.7). |
23ed8402 | 158 | .TP |
b78e3a80 | 159 | %e |
8d85a961 MK |
160 | The process or thread's |
161 | .I comm | |
162 | value, which typically is the same as the executable filename | |
163 | (without path prefix, and truncated to a maximum of 15 characters), | |
164 | but may have been modified to be something different; | |
165 | see the discussion of | |
1ae6b2c7 | 166 | .IR /proc/ pid /comm |
8d85a961 | 167 | and |
1ae6b2c7 | 168 | .IR /proc/ pid /task/ tid /comm |
8d85a961 MK |
169 | in |
170 | .BR proc (5). | |
b78e3a80 | 171 | .TP |
d7e34031 | 172 | %E |
6a7093c3 | 173 | Pathname of executable, |
b957f81f | 174 | with slashes (\[aq]/\[aq]) replaced by exclamation marks (\[aq]!\[aq]) |
c46d3d7a | 175 | (since Linux 3.0). |
d7e34031 | 176 | .TP |
b9ed1fbb | 177 | %g |
6a7093c3 | 178 | Numeric real GID of dumped process. |
b9ed1fbb MK |
179 | .TP |
180 | %h | |
6a7093c3 | 181 | Hostname (same as \fInodename\fP returned by \fBuname\fP(2)). |
b9ed1fbb | 182 | .TP |
e04ae86d MK |
183 | %i |
184 | TID of thread that triggered core dump, | |
185 | as seen in the PID namespace in which the thread resides | |
186 | .\" commit b03023ecbdb76c1dec86b41ed80b123c22783220 | |
6a7093c3 | 187 | (since Linux 3.18). |
e04ae86d MK |
188 | .TP |
189 | %I | |
190 | TID of thread that triggered core dump, as seen in the initial PID namespace | |
191 | .\" commit b03023ecbdb76c1dec86b41ed80b123c22783220 | |
6a7093c3 | 192 | (since Linux 3.18). |
e04ae86d | 193 | .TP |
b9ed1fbb MK |
194 | %p |
195 | PID of dumped process, | |
6a7093c3 | 196 | as seen in the PID namespace in which the process resides. |
b9ed1fbb | 197 | .TP |
7629685c | 198 | %P |
b9ed1fbb MK |
199 | .\" Added in git commit 65aafb1e7484b7434a0c1d4c593191ebe5776a2f |
200 | PID of dumped process, as seen in the initial PID namespace | |
6a7093c3 | 201 | (since Linux 3.12). |
b9ed1fbb MK |
202 | .TP |
203 | %s | |
6a7093c3 | 204 | Number of signal causing dump. |
b9ed1fbb MK |
205 | .TP |
206 | %t | |
6a7093c3 MK |
207 | Time of dump, expressed as seconds since the |
208 | Epoch, 1970-01-01 00:00:00 +0000 (UTC). | |
b9ed1fbb MK |
209 | .TP |
210 | %u | |
6a7093c3 | 211 | Numeric real UID of dumped process. |
b78e3a80 MK |
212 | .PD |
213 | .RE | |
c6d039a3 | 214 | .P |
c13182ef MK |
215 | A single % at the end of the template is dropped from the |
216 | core filename, as is the combination of a % followed by any | |
0be6f5cc MK |
217 | character other than those listed above. |
218 | All other characters in the template become a literal | |
219 | part of the core filename. | |
b957f81f | 220 | The template may include \[aq]/\[aq] characters, which are interpreted |
0be6f5cc | 221 | as delimiters for directory names. |
b78e3a80 | 222 | The maximum size of the resulting core filename is 128 bytes (64 bytes |
b324e17d | 223 | before Linux 2.6.19). |
0be6f5cc MK |
224 | The default value in this file is "core". |
225 | For backward compatibility, if | |
226 | .I /proc/sys/kernel/core_pattern | |
0ea48b19 MK |
227 | does not include |
228 | .I %p | |
229 | and | |
0be6f5cc MK |
230 | .I /proc/sys/kernel/core_uses_pid |
231 | (see below) | |
c7094399 | 232 | is nonzero, then .PID will be appended to the core filename. |
c6d039a3 | 233 | .P |
5c3ce796 MF |
234 | Paths are interpreted according to the settings that are active for the |
235 | crashing process. | |
4389c7ab MK |
236 | That means the crashing process's mount namespace (see |
237 | .BR mount_namespaces (7)), | |
238 | its current working directory (found via | |
5c3ce796 | 239 | .BR getcwd (2)), |
4389c7ab MK |
240 | and its root directory (see |
241 | .BR chroot (2)). | |
c6d039a3 | 242 | .P |
b324e17d | 243 | Since Linux 2.4, Linux has also provided |
10cd859a | 244 | a more primitive method of controlling |
0be6f5cc MK |
245 | the name of the core dump file. |
246 | If the | |
247 | .I /proc/sys/kernel/core_uses_pid | |
248 | file contains the value 0, then a core dump file is simply named | |
249 | .IR core . | |
c7094399 | 250 | If this file contains a nonzero value, then the core dump file includes |
0be6f5cc MK |
251 | the process ID in a name of the form |
252 | .IR core.PID . | |
c6d039a3 | 253 | .P |
4b749a12 | 254 | Since Linux 3.6, |
8c897fc6 KC |
255 | .\" 9520628e8ceb69fa9a4aee6b57f22675d9e1b709 |
256 | if | |
257 | .I /proc/sys/fs/suid_dumpable | |
4b749a12 | 258 | is set to 2 ("suidsafe"), the pattern must be either an absolute pathname |
b957f81f | 259 | (starting with a leading \[aq]/\[aq] character) or a pipe, as defined below. |
b78e3a80 | 260 | .SS Piping core dumps to a program |
b324e17d | 261 | Since Linux 2.6.19, Linux supports an alternate syntax for the |
b78e3a80 MK |
262 | .I /proc/sys/kernel/core_pattern |
263 | file. | |
264 | If the first character of this file is a pipe symbol (\fB|\fP), | |
aee42577 | 265 | then the remainder of the line is interpreted as the command-line for |
df525461 | 266 | a user-space program (or script) that is to be executed. |
c6d039a3 | 267 | .P |
b324e17d | 268 | Since Linux 5.3.0, |
344bbbd1 MK |
269 | .\" commit 315c69261dd3fa12dbc830d4fa00d1fad98d3b03 |
270 | the pipe template is split on spaces into an argument list | |
271 | .I before | |
272 | the template parameters are expanded. | |
273 | In earlier kernels, the template parameters are expanded first and | |
a33adb81 PW |
274 | the resulting string is split on spaces into an argument list. |
275 | This means that in earlier kernels executable names added by the | |
344bbbd1 MK |
276 | .I %e |
277 | and | |
278 | .I %E | |
279 | template parameters could get split into multiple arguments. | |
a33adb81 PW |
280 | So the core dump handler needs to put the executable names as the last |
281 | argument and ensure it joins all parts of the executable name using spaces. | |
282 | Executable names with multiple spaces in them are not correctly represented | |
344bbbd1 MK |
283 | in earlier kernels, |
284 | meaning that the core dump handler needs to use mechanisms to find | |
a33adb81 | 285 | the executable name. |
c6d039a3 | 286 | .P |
b665474b | 287 | Instead of being written to a file, the core dump is given as |
b78e3a80 MK |
288 | standard input to the program. |
289 | Note the following points: | |
cdede5cd | 290 | .IP \[bu] 3 |
b78e3a80 MK |
291 | The program must be specified using an absolute pathname (or a |
292 | pathname relative to the root directory, \fI/\fP), | |
293 | and must immediately follow the '|' character. | |
cdede5cd | 294 | .IP \[bu] |
089527aa MK |
295 | The command-line arguments can include any of |
296 | the % specifiers listed above. | |
297 | For example, to pass the PID of the process that is being dumped, specify | |
298 | .I %p | |
299 | in an argument. | |
cdede5cd | 300 | .IP \[bu] |
b78e3a80 MK |
301 | The process created to run the program runs as user and group |
302 | .IR root . | |
cdede5cd | 303 | .IP \[bu] |
5c3ce796 MF |
304 | Running as |
305 | .I root | |
306 | does not confer any exceptional security bypasses. | |
4389c7ab | 307 | Namely, LSMs (e.g., SELinux) are still active and may prevent the handler |
5c3ce796 | 308 | from accessing details about the crashed process via |
1ae6b2c7 | 309 | .IR /proc/ pid. |
cdede5cd | 310 | .IP \[bu] |
089527aa MK |
311 | The program pathname is interpreted with respect to the initial mount namespace |
312 | as it is always executed there. | |
313 | It is not affected by the settings | |
314 | (e.g., root directory, mount namespace, current working directory) | |
315 | of the crashing process. | |
cdede5cd | 316 | .IP \[bu] |
1c3aae54 MK |
317 | The process runs in the initial namespaces |
318 | (PID, mount, user, and so on) | |
5c3ce796 | 319 | and not in the namespaces of the crashing process. |
4389c7ab | 320 | One can utilize specifiers such as |
5c3ce796 MF |
321 | .I %P |
322 | to find the right | |
1ae6b2c7 | 323 | .IR /proc/ pid |
5c3ce796 | 324 | directory and probe/enter the crashing process's namespaces if needed. |
cdede5cd | 325 | .IP \[bu] |
9d8b2250 MK |
326 | The process starts with its current working directory |
327 | as the root directory. | |
328 | If desired, it is possible change to the working directory of | |
329 | the dumping process by employing the value provided by the | |
330 | .I %P | |
331 | specifier to change to the location of the dumping process via | |
1ae6b2c7 | 332 | .IR /proc/ pid /cwd . |
cdede5cd | 333 | .IP \[bu] |
b78e3a80 | 334 | Command-line arguments can be supplied to the |
d26a34f0 | 335 | program (since Linux 2.6.24), |
b78e3a80 | 336 | delimited by white space (up to a total line length of 128 bytes). |
cdede5cd | 337 | .IP \[bu] |
97839a76 MK |
338 | The |
339 | .B RLIMIT_CORE | |
340 | limit is not enforced for core dumps that are piped to a program | |
341 | via this mechanism. | |
d9f2d36a MK |
342 | .\" |
343 | .SS /proc/sys/kernel/core_pipe_limit | |
344 | When collecting core dumps via a pipe to a user-space program, | |
345 | it can be useful for the collecting program to gather data about | |
346 | the crashing process from that process's | |
1ae6b2c7 | 347 | .IR /proc/ pid |
d9f2d36a MK |
348 | directory. |
349 | In order to do this safely, | |
350 | the kernel must wait for the program collecting the core dump to exit, | |
351 | so as not to remove the crashing process's | |
1ae6b2c7 | 352 | .IR /proc/ pid |
d9f2d36a MK |
353 | files prematurely. |
354 | This in turn creates the | |
355 | possibility that a misbehaving collecting program can block | |
356 | the reaping of a crashed process by simply never exiting. | |
c6d039a3 | 357 | .P |
d9f2d36a MK |
358 | Since Linux 2.6.32, |
359 | .\" commit a293980c2e261bd5b0d2a77340dd04f684caff58 | |
360 | the | |
361 | .I /proc/sys/kernel/core_pipe_limit | |
362 | can be used to defend against this possibility. | |
363 | The value in this file defines how many concurrent crashing | |
364 | processes may be piped to user-space programs in parallel. | |
365 | If this value is exceeded, then those crashing processes above this value | |
366 | are noted in the kernel log and their core dumps are skipped. | |
c6d039a3 | 367 | .P |
d9f2d36a MK |
368 | A value of 0 in this file is special. |
369 | It indicates that unlimited processes may be captured in parallel, | |
370 | but that no waiting will take place (i.e., the collecting | |
371 | program is not guaranteed access to | |
b49c2acb | 372 | .IR /proc/<crashing\-PID> ). |
d9f2d36a MK |
373 | The default value for this file is 0. |
374 | .\" | |
b78e3a80 | 375 | .SS Controlling which mappings are written to the core dump |
b324e17d | 376 | Since Linux 2.6.23, the Linux-specific |
1ae6b2c7 | 377 | .IR /proc/ pid /coredump_filter |
b78e3a80 MK |
378 | file can be used to control which memory segments are written to the |
379 | core dump file in the event that a core dump is performed for the | |
380 | process with the corresponding process ID. | |
c6d039a3 | 381 | .P |
b78e3a80 MK |
382 | The value in the file is a bit mask of memory mapping types (see |
383 | .BR mmap (2)). | |
384 | If a bit is set in the mask, then memory mappings of the | |
385 | corresponding type are dumped; otherwise they are not dumped. | |
386 | The bits in this file have the following meanings: | |
c6d039a3 | 387 | .P |
b78e3a80 MK |
388 | .PD 0 |
389 | .RS 4 | |
390 | .TP | |
391 | bit 0 | |
392 | Dump anonymous private mappings. | |
393 | .TP | |
394 | bit 1 | |
395 | Dump anonymous shared mappings. | |
396 | .TP | |
397 | bit 2 | |
398 | Dump file-backed private mappings. | |
399 | .TP | |
400 | bit 3 | |
401 | Dump file-backed shared mappings. | |
402 | .\" file-backed shared mappings of course also update the underlying | |
403 | .\" mapped file. | |
cd3c7b38 MK |
404 | .TP |
405 | bit 4 (since Linux 2.6.24) | |
bb464ec1 | 406 | Dump ELF headers. |
cd3c7b38 MK |
407 | .TP |
408 | bit 5 (since Linux 2.6.28) | |
409 | Dump private huge pages. | |
410 | .TP | |
411 | bit 6 (since Linux 2.6.28) | |
412 | Dump shared huge pages. | |
db02982a RZ |
413 | .TP |
414 | bit 7 (since Linux 4.4) | |
9242ecfe | 415 | .\" commit ab27a8d04b32b6ee8c30c14c4afd1058e8addc82 |
db02982a RZ |
416 | Dump private DAX pages. |
417 | .TP | |
418 | bit 8 (since Linux 4.4) | |
9242ecfe | 419 | .\" commit ab27a8d04b32b6ee8c30c14c4afd1058e8addc82 |
db02982a | 420 | Dump shared DAX pages. |
b78e3a80 MK |
421 | .RE |
422 | .PD | |
c6d039a3 | 423 | .P |
cd3c7b38 MK |
424 | By default, the following bits are set: 0, 1, 4 (if the |
425 | .B CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS | |
426 | kernel configuration option is enabled), and 5. | |
7b28cf66 MK |
427 | This default can be modified at boot time using the |
428 | .I coredump_filter | |
429 | boot option. | |
c6d039a3 | 430 | .P |
cd3c7b38 MK |
431 | The value of this file is displayed in hexadecimal. |
432 | (The default value is thus displayed as 33.) | |
c6d039a3 | 433 | .P |
a1d5601b | 434 | Memory-mapped I/O pages such as frame buffer are never dumped, and |
0f0713a4 MK |
435 | virtual DSO |
436 | .RB ( vdso (7)) | |
437 | pages are always dumped, regardless of the | |
b78e3a80 MK |
438 | .I coredump_filter |
439 | value. | |
c6d039a3 | 440 | .P |
b78e3a80 MK |
441 | A child process created via |
442 | .BR fork (2) | |
70d70ddc | 443 | inherits its parent's |
b78e3a80 MK |
444 | .I coredump_filter |
445 | value; | |
a1d5601b | 446 | the |
b78e3a80 MK |
447 | .I coredump_filter |
448 | value is preserved across an | |
449 | .BR execve (2). | |
c6d039a3 | 450 | .P |
b78e3a80 MK |
451 | It can be useful to set |
452 | .I coredump_filter | |
453 | in the parent shell before running a program, for example: | |
c6d039a3 | 454 | .P |
b78e3a80 | 455 | .in +4n |
b8302363 | 456 | .EX |
b43a3b30 MK |
457 | .RB "$" " echo 0x7 > /proc/self/coredump_filter" |
458 | .RB "$" " ./some_program" | |
b8302363 | 459 | .EE |
b78e3a80 | 460 | .in |
c6d039a3 | 461 | .P |
33a0ccb2 | 462 | This file is provided only if the kernel was built with the |
e242920a MK |
463 | .B CONFIG_ELF_CORE |
464 | configuration option. | |
03c87136 MK |
465 | .\" |
466 | .SS Core dumps and systemd | |
467 | On systems using the | |
468 | .BR systemd (1) | |
469 | .I init | |
470 | framework, core dumps may be placed in a location determined by | |
471 | .BR systemd (1). | |
472 | To do this, | |
473 | .BR systemd (1) | |
474 | employs the | |
475 | .I core_pattern | |
dc4674ac | 476 | feature that allows piping core dumps to a program. |
03c87136 | 477 | One can verify this by checking whether core dumps are being piped to the |
4818bee5 | 478 | .BR systemd\-coredump (8) |
03c87136 | 479 | program: |
c6d039a3 | 480 | .P |
03c87136 MK |
481 | .in +4n |
482 | .EX | |
483 | $ \fBcat /proc/sys/kernel/core_pattern\fP | |
4818bee5 | 484 | |/usr/lib/systemd/systemd\-coredump %P %u %g %s %t %c %e |
03c87136 MK |
485 | .EE |
486 | .in | |
c6d039a3 | 487 | .P |
03c87136 | 488 | In this case, core dumps will be placed in the location configured for |
4818bee5 | 489 | .BR systemd\-coredump (8), |
03c87136 MK |
490 | typically as |
491 | .BR lz4 (1) | |
492 | compressed files in the directory | |
493 | .IR /var/lib/systemd/coredump/ . | |
494 | One can list the core dumps that have been recorded by | |
4818bee5 | 495 | .BR systemd\-coredump (8) |
03c87136 MK |
496 | using |
497 | .BR coredumpctl (1): | |
c6d039a3 | 498 | .P |
03c87136 | 499 | .EX |
d064d41a MK |
500 | $ \fBcoredumpctl list | tail \-5\fP |
501 | Wed 2017\-10\-11 22:25:30 CEST 2748 1000 1000 3 present /usr/bin/sleep | |
502 | Thu 2017\-10\-12 06:29:10 CEST 2716 1000 1000 3 present /usr/bin/sleep | |
503 | Thu 2017\-10\-12 06:30:50 CEST 2767 1000 1000 3 present /usr/bin/sleep | |
504 | Thu 2017\-10\-12 06:37:40 CEST 2918 1000 1000 3 present /usr/bin/cat | |
505 | Thu 2017\-10\-12 08:13:07 CEST 2955 1000 1000 3 present /usr/bin/cat | |
03c87136 | 506 | .EE |
c6d039a3 | 507 | .P |
03c87136 MK |
508 | The information shown for each core dump includes the date and time |
509 | of the dump, the PID, UID, and GID of the dumping process, | |
510 | the signal number that caused the core dump, | |
511 | and the pathname of the executable that was being run by the dumped process. | |
512 | Various options to | |
513 | .BR coredumpctl (1) | |
514 | allow a specified coredump file to be pulled from the | |
515 | .BR systemd (1) | |
516 | location into a specified file. | |
517 | For example, to extract the core dump for PID 2955 shown above to a file named | |
1ae6b2c7 | 518 | .I core |
dc4674ac | 519 | in the current directory, one could use: |
c6d039a3 | 520 | .P |
03c87136 MK |
521 | .in +4n |
522 | .EX | |
4818bee5 | 523 | $ \fBcoredumpctl dump 2955 \-o core\fP |
03c87136 MK |
524 | .EE |
525 | .in | |
c6d039a3 | 526 | .P |
03c87136 MK |
527 | For more extensive details, see the |
528 | .BR coredumpctl (1) | |
529 | manual page. | |
c6d039a3 | 530 | .P |
8626fdd2 | 531 | To (persistently) disable the |
03c87136 MK |
532 | .BR systemd (1) |
533 | mechanism that archives core dumps, restoring to something more like | |
534 | traditional Linux behavior, one can set an override for the | |
535 | .BR systemd (1) | |
536 | mechanism, using something like: | |
c6d039a3 | 537 | .P |
94c50673 | 538 | .in +4n |
03c87136 | 539 | .EX |
94c50673 MK |
540 | # \fBecho "kernel.core_pattern=core.%p" > \e\fP |
541 | \fB /etc/sysctl.d/50\-coredump.conf\fP | |
7ef59574 | 542 | # \fB/lib/systemd/systemd\-sysctl\fP |
03c87136 MK |
543 | .EE |
544 | .in | |
c6d039a3 | 545 | .P |
8626fdd2 | 546 | It is also possible to temporarily (i.e., until the next reboot) change the |
24581849 | 547 | .I core_pattern |
8626fdd2 MK |
548 | setting using a command such as the following |
549 | (which causes the names of core dump files to include the executable name | |
550 | as well as the number of the signal which triggered the core dump): | |
c6d039a3 | 551 | .P |
8626fdd2 MK |
552 | .in +4n |
553 | .EX | |
554 | # \fBsysctl \-w kernel.core_pattern="%e\-%s.core"\fP | |
555 | .EE | |
556 | .in | |
03c87136 | 557 | .\" |
0be6f5cc | 558 | .SH NOTES |
c13182ef | 559 | The |
0be6f5cc MK |
560 | .BR gdb (1) |
561 | .I gcore | |
562 | command can be used to obtain a core dump of a running process. | |
c6d039a3 | 563 | .P |
173e4d50 MK |
564 | In Linux versions up to and including 2.6.27, |
565 | .\" Changed with commit 6409324b385f3f63a03645b4422e3be67348d922 | |
566 | if a multithreaded process (or, more precisely, a process that | |
5ddfb8c7 MK |
567 | shares its memory with another process by being created with the |
568 | .B CLONE_VM | |
569 | flag of | |
570 | .BR clone (2)) | |
c13182ef | 571 | dumps core, then the process ID is always appended to the core filename, |
d216b211 | 572 | unless the process ID was already included elsewhere in the |
0ea48b19 MK |
573 | filename via a |
574 | .I %p | |
575 | specification in | |
5ddfb8c7 | 576 | .IR /proc/sys/kernel/core_pattern . |
173e4d50 MK |
577 | (This is primarily useful when employing the obsolete |
578 | LinuxThreads implementation, | |
b8424e6a | 579 | where each thread of a process has a different PID.) |
4b47fc34 MK |
580 | .\" Always including the PID in the name of the core file made |
581 | .\" sense for LinuxThreads, where each thread had a unique PID, | |
905e99f2 | 582 | .\" but doesn't seem to serve any purpose with NPTL, where all the |
c13182ef | 583 | .\" threads in a process share the same PID (as POSIX.1 requires). |
d9bfdb9c | 584 | .\" Probably the behavior is maintained so that applications using |
c13182ef | 585 | .\" LinuxThreads continue appending the PID (the kernel has no easy |
7fac88a9 | 586 | .\" way of telling which threading implementation the user-space |
d216b211 | 587 | .\" application is using). -- mtk, April 2006 |
a14af333 | 588 | .SH EXAMPLES |
b78e3a80 | 589 | The program below can be used to demonstrate the use of the |
a1d5601b | 590 | pipe syntax in the |
b78e3a80 MK |
591 | .I /proc/sys/kernel/core_pattern |
592 | file. | |
593 | The following shell session demonstrates the use of this program | |
594 | (compiled to create an executable named | |
595 | .IR core_pattern_pipe_test ): | |
c6d039a3 | 596 | .P |
b78e3a80 | 597 | .in +4n |
b8302363 | 598 | .EX |
b43a3b30 MK |
599 | .RB "$" " cc \-o core_pattern_pipe_test core_pattern_pipe_test.c" |
600 | .RB "$" " su" | |
b78e3a80 | 601 | Password: |
9c708002 AC |
602 | .RB "#" " echo \[dq]|$PWD/core_pattern_pipe_test %p \ |
603 | UID=%u GID=%g sig=%s\[dq] > \e" | |
b43a3b30 MK |
604 | .B " /proc/sys/kernel/core_pattern" |
605 | .RB "#" " exit" | |
606 | .RB "$" " sleep 100" | |
a1e9245d | 607 | .BR "\[ha]\e" " # type control\-backslash" |
b78e3a80 | 608 | Quit (core dumped) |
b43a3b30 | 609 | .RB "$" " cat core.info" |
b78e3a80 MK |
610 | argc=5 |
611 | argc[0]=</home/mtk/core_pattern_pipe_test> | |
612 | argc[1]=<20575> | |
613 | argc[2]=<UID=1000> | |
614 | argc[3]=<GID=100> | |
615 | argc[4]=<sig=3> | |
616 | Total bytes in core dump: 282624 | |
b8302363 | 617 | .EE |
b78e3a80 | 618 | .in |
9c330504 | 619 | .SS Program source |
d84d0300 | 620 | \& |
e7d0bb47 | 621 | .EX |
b78e3a80 | 622 | /* core_pattern_pipe_test.c */ |
fe5dba13 | 623 | \& |
b78e3a80 MK |
624 | #define _GNU_SOURCE |
625 | #include <sys/stat.h> | |
626 | #include <fcntl.h> | |
627 | #include <limits.h> | |
628 | #include <stdio.h> | |
629 | #include <stdlib.h> | |
630 | #include <unistd.h> | |
fe5dba13 | 631 | \& |
b78e3a80 | 632 | #define BUF_SIZE 1024 |
fe5dba13 | 633 | \& |
b78e3a80 MK |
634 | int |
635 | main(int argc, char *argv[]) | |
636 | { | |
95cc0897 | 637 | ssize_t nread, tot; |
b78e3a80 MK |
638 | char buf[BUF_SIZE]; |
639 | FILE *fp; | |
640 | char cwd[PATH_MAX]; | |
fe5dba13 | 641 | \& |
a1d5601b | 642 | /* Change our current working directory to that of the |
46b20ca1 | 643 | crashing process. */ |
fe5dba13 | 644 | \& |
b78e3a80 MK |
645 | snprintf(cwd, PATH_MAX, "/proc/%s/cwd", argv[1]); |
646 | chdir(cwd); | |
fe5dba13 | 647 | \& |
46b20ca1 | 648 | /* Write output to file "core.info" in that directory. */ |
fe5dba13 | 649 | \& |
b78e3a80 MK |
650 | fp = fopen("core.info", "w+"); |
651 | if (fp == NULL) | |
652 | exit(EXIT_FAILURE); | |
fe5dba13 | 653 | \& |
b78e3a80 | 654 | /* Display command\-line arguments given to core_pattern |
46b20ca1 | 655 | pipe program. */ |
fe5dba13 | 656 | \& |
d1a71985 | 657 | fprintf(fp, "argc=%d\en", argc); |
b42296e4 AC |
658 | for (size_t j = 0; j < argc; j++) |
659 | fprintf(fp, "argc[%zu]=<%s>\en", j, argv[j]); | |
fe5dba13 | 660 | \& |
46b20ca1 | 661 | /* Count bytes in standard input (the core dump). */ |
fe5dba13 | 662 | \& |
b78e3a80 | 663 | tot = 0; |
a1d5601b | 664 | while ((nread = read(STDIN_FILENO, buf, BUF_SIZE)) > 0) |
b78e3a80 | 665 | tot += nread; |
95cc0897 | 666 | fprintf(fp, "Total bytes in core dump: %zd\en", tot); |
fe5dba13 | 667 | \& |
aaec25cb | 668 | fclose(fp); |
b78e3a80 MK |
669 | exit(EXIT_SUCCESS); |
670 | } | |
e7d0bb47 | 671 | .EE |
0be6f5cc | 672 | .SH SEE ALSO |
a2aac039 | 673 | .BR bash (1), |
cb1b1630 | 674 | .BR coredumpctl (1), |
0be6f5cc MK |
675 | .BR gdb (1), |
676 | .BR getrlimit (2), | |
a8b32c31 | 677 | .BR mmap (2), |
0be6f5cc MK |
678 | .BR prctl (2), |
679 | .BR sigaction (2), | |
680 | .BR elf (5), | |
681 | .BR proc (5), | |
b8424e6a | 682 | .BR pthreads (7), |
a971f652 | 683 | .BR signal (7), |
4818bee5 | 684 | .BR systemd\-coredump (8) |