]>
Commit | Line | Data |
---|---|---|
b78e3a80 | 1 | .\" Copyright (c) 2006, 2008 by Michael Kerrisk <mtk.manpages@gmail.com> |
0be6f5cc | 2 | .\" |
5fbde956 | 3 | .\" SPDX-License-Identifier: Linux-man-pages-copyleft |
0be6f5cc | 4 | .\" |
4c1c5274 | 5 | .TH core 5 (date) "Linux man-pages (unreleased)" |
0be6f5cc MK |
6 | .SH NAME |
7 | core \- core dump file | |
8 | .SH DESCRIPTION | |
c13182ef | 9 | The default action of certain signals is to cause a process to terminate |
0be6f5cc MK |
10 | and produce a |
11 | .IR "core dump file" , | |
b665474b | 12 | a file containing an image of the process's memory at |
0be6f5cc | 13 | the time of termination. |
78890124 MK |
14 | This image can be used in a debugger (e.g., |
15 | .BR gdb (1)) | |
16 | to inspect the state of the program at the time that it terminated. | |
0be6f5cc MK |
17 | A list of the signals which cause a process to dump core can be found in |
18 | .BR signal (7). | |
2dad4c59 | 19 | .PP |
53cd945e | 20 | A process can set its soft |
0daa9e92 | 21 | .B RLIMIT_CORE |
c13182ef | 22 | resource limit to place an upper limit on the size of the core dump file |
0be6f5cc MK |
23 | that will be produced if it receives a "core dump" signal; see |
24 | .BR getrlimit (2) | |
25 | for details. | |
2dad4c59 | 26 | .PP |
c13182ef | 27 | There are various circumstances in which a core dump file is |
0be6f5cc | 28 | not produced: |
22356d97 | 29 | .IP \(bu 3 |
67ed0e4b | 30 | The process does not have permission to write the core file. |
91aabea5 | 31 | (By default, the core file is called |
1ae6b2c7 | 32 | .I core |
ab0f60c6 MK |
33 | or |
34 | .IR core.pid , | |
35 | where | |
36 | .I pid | |
37 | is the ID of the process that dumped core, | |
c13182ef | 38 | and is created in the current working directory. |
67ed0e4b | 39 | See below for details on naming.) |
a23d8efa | 40 | Writing the core file fails if the directory in which |
b665474b | 41 | it is to be created is not writable, |
c13182ef | 42 | or if a file with the same name exists and |
67ed0e4b | 43 | is not writable |
c13182ef | 44 | or is not a regular file |
67ed0e4b | 45 | (e.g., it is a directory or a symbolic link). |
22356d97 | 46 | .IP \(bu |
c13182ef MK |
47 | A (writable, regular) file with the same name as would be used for the |
48 | core dump already exists, but there is more than one hard link to that | |
10cd859a | 49 | file. |
22356d97 | 50 | .IP \(bu |
9ee4a2b6 | 51 | The filesystem where the core dump file would be created is full; |
972a8ec7 | 52 | or has run out of inodes; or is mounted read-only; |
9ee4a2b6 | 53 | or the user has reached their quota for the filesystem. |
22356d97 | 54 | .IP \(bu |
c13182ef | 55 | The directory in which the core dump file is to be created does |
67ed0e4b | 56 | not exist. |
22356d97 | 57 | .IP \(bu |
78890124 | 58 | The |
0be6f5cc | 59 | .B RLIMIT_CORE |
78890124 | 60 | (core file size) or |
0be6f5cc | 61 | .B RLIMIT_FSIZE |
78890124 MK |
62 | (file size) resource limits for the process are set to zero; see |
63 | .BR getrlimit (2) | |
64 | and the documentation of the shell's | |
65 | .I ulimit | |
66 | command | |
67 | .RI ( limit | |
68 | in | |
69 | .BR csh (1)). | |
22356d97 | 70 | .IP \(bu |
c13182ef | 71 | The binary being executed by the process does not have read |
0be6f5cc | 72 | permission enabled. |
2f0e61ae MK |
73 | (This is a security measure to |
74 | ensure that an executable whose contents are not readable | |
75 | does not produce a\(empossibly readable\(emcore dump containing | |
76 | an image of the executable.) | |
22356d97 | 77 | .IP \(bu |
0be6f5cc | 78 | The process is executing a set-user-ID (set-group-ID) program |
c13182ef | 79 | that is owned by a user (group) other than the real user (group) |
60a119dd MK |
80 | ID of the process, |
81 | or the process is executing a program that has file capabilities (see | |
82 | .BR capabilities (7)). | |
0be6f5cc MK |
83 | (However, see the description of the |
84 | .BR prctl (2) | |
85 | .B PR_SET_DUMPABLE | |
86 | operation, and the description of the | |
87 | .I /proc/sys/fs/suid_dumpable | |
14523015 MK |
88 | .\" FIXME . Perhaps relocate discussion of /proc/sys/fs/suid_dumpable |
89 | .\" and PR_SET_DUMPABLE to this page? | |
0be6f5cc MK |
90 | file in |
91 | .BR proc (5).) | |
22356d97 | 92 | .IP \(bu |
6c3d8859 MK |
93 | .I /proc/sys/kernel/core_pattern |
94 | is empty and | |
95 | .I /proc/sys/kernel/core_uses_pid | |
96 | contains the value 0. | |
97 | (These files are described below.) | |
98 | Note that if | |
99 | .I /proc/sys/kernel/core_pattern | |
100 | is empty and | |
101 | .I /proc/sys/kernel/core_uses_pid | |
102 | contains the value 1, | |
103 | core dump files will have names of the form | |
104 | .IR .pid , | |
105 | and such files are hidden unless one uses the | |
106 | .BR ls (1) | |
4818bee5 | 107 | .I \-a |
6c3d8859 | 108 | option. |
22356d97 | 109 | .IP \(bu |
d298e17f MK |
110 | (Since Linux 3.7) |
111 | .\" commit 046d662f481830e652ac34cd112249adde16452a | |
112 | The kernel was configured without the | |
1ae6b2c7 | 113 | .B CONFIG_COREDUMP |
d298e17f | 114 | option. |
0ac3f06f MK |
115 | .PP |
116 | In addition, | |
117 | a core dump may exclude part of the address space of the process if the | |
118 | .BR madvise (2) | |
119 | .B MADV_DONTDUMP | |
120 | flag was employed. | |
03c87136 MK |
121 | .PP |
122 | On systems that employ | |
123 | .BR systemd (1) | |
124 | as the | |
125 | .I init | |
126 | framework, core dumps may instead be placed in a location determined by | |
127 | .BR systemd (1). | |
128 | See below for further details. | |
129 | .\" | |
0be6f5cc | 130 | .SS Naming of core dump files |
c13182ef | 131 | By default, a core dump file is named |
0be6f5cc | 132 | .IR core , |
c13182ef | 133 | but the |
0be6f5cc | 134 | .I /proc/sys/kernel/core_pattern |
b78e3a80 | 135 | file (since Linux 2.6 and 2.4.21) |
0be6f5cc MK |
136 | can be set to define a template that is used to name core dump files. |
137 | The template can contain % specifiers which are substituted | |
138 | by the following values when a core file is created: | |
b78e3a80 MK |
139 | .PP |
140 | .RS 4 | |
141 | .PD 0 | |
142 | .TP 4 | |
143 | %% | |
6a7093c3 | 144 | A single % character. |
b78e3a80 | 145 | .TP |
b9ed1fbb | 146 | %c |
6a7093c3 | 147 | Core file size soft resource limit of crashing process (since Linux 2.6.24). |
b78e3a80 | 148 | .TP |
23ed8402 | 149 | %d |
fd9c713b | 150 | .\" Added in git commit 12a2b4b2241e318b4f6df31228e4272d2c2968a1 |
6a7093c3 | 151 | Dump mode\(emsame as value returned by |
fd9c713b MK |
152 | .BR prctl (2) |
153 | .B PR_GET_DUMPABLE | |
6a7093c3 | 154 | (since Linux 3.7). |
23ed8402 | 155 | .TP |
b78e3a80 | 156 | %e |
8d85a961 MK |
157 | The process or thread's |
158 | .I comm | |
159 | value, which typically is the same as the executable filename | |
160 | (without path prefix, and truncated to a maximum of 15 characters), | |
161 | but may have been modified to be something different; | |
162 | see the discussion of | |
1ae6b2c7 | 163 | .IR /proc/ pid /comm |
8d85a961 | 164 | and |
1ae6b2c7 | 165 | .IR /proc/ pid /task/ tid /comm |
8d85a961 MK |
166 | in |
167 | .BR proc (5). | |
b78e3a80 | 168 | .TP |
d7e34031 | 169 | %E |
6a7093c3 | 170 | Pathname of executable, |
c46d3d7a BW |
171 | with slashes (\(aq/\(aq) replaced by exclamation marks (\(aq!\(aq) |
172 | (since Linux 3.0). | |
d7e34031 | 173 | .TP |
b9ed1fbb | 174 | %g |
6a7093c3 | 175 | Numeric real GID of dumped process. |
b9ed1fbb MK |
176 | .TP |
177 | %h | |
6a7093c3 | 178 | Hostname (same as \fInodename\fP returned by \fBuname\fP(2)). |
b9ed1fbb | 179 | .TP |
e04ae86d MK |
180 | %i |
181 | TID of thread that triggered core dump, | |
182 | as seen in the PID namespace in which the thread resides | |
183 | .\" commit b03023ecbdb76c1dec86b41ed80b123c22783220 | |
6a7093c3 | 184 | (since Linux 3.18). |
e04ae86d MK |
185 | .TP |
186 | %I | |
187 | TID of thread that triggered core dump, as seen in the initial PID namespace | |
188 | .\" commit b03023ecbdb76c1dec86b41ed80b123c22783220 | |
6a7093c3 | 189 | (since Linux 3.18). |
e04ae86d | 190 | .TP |
b9ed1fbb MK |
191 | %p |
192 | PID of dumped process, | |
6a7093c3 | 193 | as seen in the PID namespace in which the process resides. |
b9ed1fbb | 194 | .TP |
7629685c | 195 | %P |
b9ed1fbb MK |
196 | .\" Added in git commit 65aafb1e7484b7434a0c1d4c593191ebe5776a2f |
197 | PID of dumped process, as seen in the initial PID namespace | |
6a7093c3 | 198 | (since Linux 3.12). |
b9ed1fbb MK |
199 | .TP |
200 | %s | |
6a7093c3 | 201 | Number of signal causing dump. |
b9ed1fbb MK |
202 | .TP |
203 | %t | |
6a7093c3 MK |
204 | Time of dump, expressed as seconds since the |
205 | Epoch, 1970-01-01 00:00:00 +0000 (UTC). | |
b9ed1fbb MK |
206 | .TP |
207 | %u | |
6a7093c3 | 208 | Numeric real UID of dumped process. |
b78e3a80 MK |
209 | .PD |
210 | .RE | |
211 | .PP | |
c13182ef MK |
212 | A single % at the end of the template is dropped from the |
213 | core filename, as is the combination of a % followed by any | |
0be6f5cc MK |
214 | character other than those listed above. |
215 | All other characters in the template become a literal | |
216 | part of the core filename. | |
f81fb444 | 217 | The template may include \(aq/\(aq characters, which are interpreted |
0be6f5cc | 218 | as delimiters for directory names. |
b78e3a80 MK |
219 | The maximum size of the resulting core filename is 128 bytes (64 bytes |
220 | in kernels before 2.6.19). | |
0be6f5cc MK |
221 | The default value in this file is "core". |
222 | For backward compatibility, if | |
223 | .I /proc/sys/kernel/core_pattern | |
0ea48b19 MK |
224 | does not include |
225 | .I %p | |
226 | and | |
0be6f5cc MK |
227 | .I /proc/sys/kernel/core_uses_pid |
228 | (see below) | |
c7094399 | 229 | is nonzero, then .PID will be appended to the core filename. |
2dad4c59 | 230 | .PP |
5c3ce796 MF |
231 | Paths are interpreted according to the settings that are active for the |
232 | crashing process. | |
4389c7ab MK |
233 | That means the crashing process's mount namespace (see |
234 | .BR mount_namespaces (7)), | |
235 | its current working directory (found via | |
5c3ce796 | 236 | .BR getcwd (2)), |
4389c7ab MK |
237 | and its root directory (see |
238 | .BR chroot (2)). | |
2dad4c59 | 239 | .PP |
10cd859a MK |
240 | Since version 2.4, Linux has also provided |
241 | a more primitive method of controlling | |
0be6f5cc MK |
242 | the name of the core dump file. |
243 | If the | |
244 | .I /proc/sys/kernel/core_uses_pid | |
245 | file contains the value 0, then a core dump file is simply named | |
246 | .IR core . | |
c7094399 | 247 | If this file contains a nonzero value, then the core dump file includes |
0be6f5cc MK |
248 | the process ID in a name of the form |
249 | .IR core.PID . | |
2dad4c59 | 250 | .PP |
4b749a12 | 251 | Since Linux 3.6, |
8c897fc6 KC |
252 | .\" 9520628e8ceb69fa9a4aee6b57f22675d9e1b709 |
253 | if | |
254 | .I /proc/sys/fs/suid_dumpable | |
4b749a12 | 255 | is set to 2 ("suidsafe"), the pattern must be either an absolute pathname |
8c897fc6 | 256 | (starting with a leading \(aq/\(aq character) or a pipe, as defined below. |
b78e3a80 MK |
257 | .SS Piping core dumps to a program |
258 | Since kernel 2.6.19, Linux supports an alternate syntax for the | |
259 | .I /proc/sys/kernel/core_pattern | |
260 | file. | |
261 | If the first character of this file is a pipe symbol (\fB|\fP), | |
aee42577 | 262 | then the remainder of the line is interpreted as the command-line for |
df525461 | 263 | a user-space program (or script) that is to be executed. |
a33adb81 | 264 | .PP |
344bbbd1 MK |
265 | Since kernel 5.3.0, |
266 | .\" commit 315c69261dd3fa12dbc830d4fa00d1fad98d3b03 | |
267 | the pipe template is split on spaces into an argument list | |
268 | .I before | |
269 | the template parameters are expanded. | |
270 | In earlier kernels, the template parameters are expanded first and | |
a33adb81 PW |
271 | the resulting string is split on spaces into an argument list. |
272 | This means that in earlier kernels executable names added by the | |
344bbbd1 MK |
273 | .I %e |
274 | and | |
275 | .I %E | |
276 | template parameters could get split into multiple arguments. | |
a33adb81 PW |
277 | So the core dump handler needs to put the executable names as the last |
278 | argument and ensure it joins all parts of the executable name using spaces. | |
279 | Executable names with multiple spaces in them are not correctly represented | |
344bbbd1 MK |
280 | in earlier kernels, |
281 | meaning that the core dump handler needs to use mechanisms to find | |
a33adb81 PW |
282 | the executable name. |
283 | .PP | |
b665474b | 284 | Instead of being written to a file, the core dump is given as |
b78e3a80 MK |
285 | standard input to the program. |
286 | Note the following points: | |
22356d97 | 287 | .IP \(bu 3 |
b78e3a80 MK |
288 | The program must be specified using an absolute pathname (or a |
289 | pathname relative to the root directory, \fI/\fP), | |
290 | and must immediately follow the '|' character. | |
22356d97 | 291 | .IP \(bu |
089527aa MK |
292 | The command-line arguments can include any of |
293 | the % specifiers listed above. | |
294 | For example, to pass the PID of the process that is being dumped, specify | |
295 | .I %p | |
296 | in an argument. | |
22356d97 | 297 | .IP \(bu |
b78e3a80 MK |
298 | The process created to run the program runs as user and group |
299 | .IR root . | |
22356d97 | 300 | .IP \(bu |
5c3ce796 MF |
301 | Running as |
302 | .I root | |
303 | does not confer any exceptional security bypasses. | |
4389c7ab | 304 | Namely, LSMs (e.g., SELinux) are still active and may prevent the handler |
5c3ce796 | 305 | from accessing details about the crashed process via |
1ae6b2c7 | 306 | .IR /proc/ pid. |
22356d97 | 307 | .IP \(bu |
089527aa MK |
308 | The program pathname is interpreted with respect to the initial mount namespace |
309 | as it is always executed there. | |
310 | It is not affected by the settings | |
311 | (e.g., root directory, mount namespace, current working directory) | |
312 | of the crashing process. | |
22356d97 | 313 | .IP \(bu |
1c3aae54 MK |
314 | The process runs in the initial namespaces |
315 | (PID, mount, user, and so on) | |
5c3ce796 | 316 | and not in the namespaces of the crashing process. |
4389c7ab | 317 | One can utilize specifiers such as |
5c3ce796 MF |
318 | .I %P |
319 | to find the right | |
1ae6b2c7 | 320 | .IR /proc/ pid |
5c3ce796 | 321 | directory and probe/enter the crashing process's namespaces if needed. |
22356d97 | 322 | .IP \(bu |
9d8b2250 MK |
323 | The process starts with its current working directory |
324 | as the root directory. | |
325 | If desired, it is possible change to the working directory of | |
326 | the dumping process by employing the value provided by the | |
327 | .I %P | |
328 | specifier to change to the location of the dumping process via | |
1ae6b2c7 | 329 | .IR /proc/ pid /cwd . |
22356d97 | 330 | .IP \(bu |
b78e3a80 | 331 | Command-line arguments can be supplied to the |
d26a34f0 | 332 | program (since Linux 2.6.24), |
b78e3a80 | 333 | delimited by white space (up to a total line length of 128 bytes). |
22356d97 | 334 | .IP \(bu |
97839a76 MK |
335 | The |
336 | .B RLIMIT_CORE | |
337 | limit is not enforced for core dumps that are piped to a program | |
338 | via this mechanism. | |
d9f2d36a MK |
339 | .\" |
340 | .SS /proc/sys/kernel/core_pipe_limit | |
341 | When collecting core dumps via a pipe to a user-space program, | |
342 | it can be useful for the collecting program to gather data about | |
343 | the crashing process from that process's | |
1ae6b2c7 | 344 | .IR /proc/ pid |
d9f2d36a MK |
345 | directory. |
346 | In order to do this safely, | |
347 | the kernel must wait for the program collecting the core dump to exit, | |
348 | so as not to remove the crashing process's | |
1ae6b2c7 | 349 | .IR /proc/ pid |
d9f2d36a MK |
350 | files prematurely. |
351 | This in turn creates the | |
352 | possibility that a misbehaving collecting program can block | |
353 | the reaping of a crashed process by simply never exiting. | |
2dad4c59 | 354 | .PP |
d9f2d36a MK |
355 | Since Linux 2.6.32, |
356 | .\" commit a293980c2e261bd5b0d2a77340dd04f684caff58 | |
357 | the | |
358 | .I /proc/sys/kernel/core_pipe_limit | |
359 | can be used to defend against this possibility. | |
360 | The value in this file defines how many concurrent crashing | |
361 | processes may be piped to user-space programs in parallel. | |
362 | If this value is exceeded, then those crashing processes above this value | |
363 | are noted in the kernel log and their core dumps are skipped. | |
2dad4c59 | 364 | .PP |
d9f2d36a MK |
365 | A value of 0 in this file is special. |
366 | It indicates that unlimited processes may be captured in parallel, | |
367 | but that no waiting will take place (i.e., the collecting | |
368 | program is not guaranteed access to | |
b49c2acb | 369 | .IR /proc/<crashing\-PID> ). |
d9f2d36a MK |
370 | The default value for this file is 0. |
371 | .\" | |
b78e3a80 MK |
372 | .SS Controlling which mappings are written to the core dump |
373 | Since kernel 2.6.23, the Linux-specific | |
1ae6b2c7 | 374 | .IR /proc/ pid /coredump_filter |
b78e3a80 MK |
375 | file can be used to control which memory segments are written to the |
376 | core dump file in the event that a core dump is performed for the | |
377 | process with the corresponding process ID. | |
2dad4c59 | 378 | .PP |
b78e3a80 MK |
379 | The value in the file is a bit mask of memory mapping types (see |
380 | .BR mmap (2)). | |
381 | If a bit is set in the mask, then memory mappings of the | |
382 | corresponding type are dumped; otherwise they are not dumped. | |
383 | The bits in this file have the following meanings: | |
384 | .PP | |
385 | .PD 0 | |
386 | .RS 4 | |
387 | .TP | |
388 | bit 0 | |
389 | Dump anonymous private mappings. | |
390 | .TP | |
391 | bit 1 | |
392 | Dump anonymous shared mappings. | |
393 | .TP | |
394 | bit 2 | |
395 | Dump file-backed private mappings. | |
396 | .TP | |
397 | bit 3 | |
398 | Dump file-backed shared mappings. | |
399 | .\" file-backed shared mappings of course also update the underlying | |
400 | .\" mapped file. | |
cd3c7b38 MK |
401 | .TP |
402 | bit 4 (since Linux 2.6.24) | |
bb464ec1 | 403 | Dump ELF headers. |
cd3c7b38 MK |
404 | .TP |
405 | bit 5 (since Linux 2.6.28) | |
406 | Dump private huge pages. | |
407 | .TP | |
408 | bit 6 (since Linux 2.6.28) | |
409 | Dump shared huge pages. | |
db02982a RZ |
410 | .TP |
411 | bit 7 (since Linux 4.4) | |
9242ecfe | 412 | .\" commit ab27a8d04b32b6ee8c30c14c4afd1058e8addc82 |
db02982a RZ |
413 | Dump private DAX pages. |
414 | .TP | |
415 | bit 8 (since Linux 4.4) | |
9242ecfe | 416 | .\" commit ab27a8d04b32b6ee8c30c14c4afd1058e8addc82 |
db02982a | 417 | Dump shared DAX pages. |
b78e3a80 MK |
418 | .RE |
419 | .PD | |
420 | .PP | |
cd3c7b38 MK |
421 | By default, the following bits are set: 0, 1, 4 (if the |
422 | .B CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS | |
423 | kernel configuration option is enabled), and 5. | |
7b28cf66 MK |
424 | This default can be modified at boot time using the |
425 | .I coredump_filter | |
426 | boot option. | |
2dad4c59 | 427 | .PP |
cd3c7b38 MK |
428 | The value of this file is displayed in hexadecimal. |
429 | (The default value is thus displayed as 33.) | |
2dad4c59 | 430 | .PP |
a1d5601b | 431 | Memory-mapped I/O pages such as frame buffer are never dumped, and |
0f0713a4 MK |
432 | virtual DSO |
433 | .RB ( vdso (7)) | |
434 | pages are always dumped, regardless of the | |
b78e3a80 MK |
435 | .I coredump_filter |
436 | value. | |
2dad4c59 | 437 | .PP |
b78e3a80 MK |
438 | A child process created via |
439 | .BR fork (2) | |
70d70ddc | 440 | inherits its parent's |
b78e3a80 MK |
441 | .I coredump_filter |
442 | value; | |
a1d5601b | 443 | the |
b78e3a80 MK |
444 | .I coredump_filter |
445 | value is preserved across an | |
446 | .BR execve (2). | |
2dad4c59 | 447 | .PP |
b78e3a80 MK |
448 | It can be useful to set |
449 | .I coredump_filter | |
450 | in the parent shell before running a program, for example: | |
2dad4c59 | 451 | .PP |
b78e3a80 | 452 | .in +4n |
b8302363 | 453 | .EX |
b43a3b30 MK |
454 | .RB "$" " echo 0x7 > /proc/self/coredump_filter" |
455 | .RB "$" " ./some_program" | |
b8302363 | 456 | .EE |
b78e3a80 MK |
457 | .in |
458 | .PP | |
33a0ccb2 | 459 | This file is provided only if the kernel was built with the |
e242920a MK |
460 | .B CONFIG_ELF_CORE |
461 | configuration option. | |
03c87136 MK |
462 | .\" |
463 | .SS Core dumps and systemd | |
464 | On systems using the | |
465 | .BR systemd (1) | |
466 | .I init | |
467 | framework, core dumps may be placed in a location determined by | |
468 | .BR systemd (1). | |
469 | To do this, | |
470 | .BR systemd (1) | |
471 | employs the | |
472 | .I core_pattern | |
dc4674ac | 473 | feature that allows piping core dumps to a program. |
03c87136 | 474 | One can verify this by checking whether core dumps are being piped to the |
4818bee5 | 475 | .BR systemd\-coredump (8) |
03c87136 MK |
476 | program: |
477 | .PP | |
478 | .in +4n | |
479 | .EX | |
480 | $ \fBcat /proc/sys/kernel/core_pattern\fP | |
4818bee5 | 481 | |/usr/lib/systemd/systemd\-coredump %P %u %g %s %t %c %e |
03c87136 MK |
482 | .EE |
483 | .in | |
484 | .PP | |
485 | In this case, core dumps will be placed in the location configured for | |
4818bee5 | 486 | .BR systemd\-coredump (8), |
03c87136 MK |
487 | typically as |
488 | .BR lz4 (1) | |
489 | compressed files in the directory | |
490 | .IR /var/lib/systemd/coredump/ . | |
491 | One can list the core dumps that have been recorded by | |
4818bee5 | 492 | .BR systemd\-coredump (8) |
03c87136 MK |
493 | using |
494 | .BR coredumpctl (1): | |
495 | .PP | |
03c87136 | 496 | .EX |
d064d41a MK |
497 | $ \fBcoredumpctl list | tail \-5\fP |
498 | Wed 2017\-10\-11 22:25:30 CEST 2748 1000 1000 3 present /usr/bin/sleep | |
499 | Thu 2017\-10\-12 06:29:10 CEST 2716 1000 1000 3 present /usr/bin/sleep | |
500 | Thu 2017\-10\-12 06:30:50 CEST 2767 1000 1000 3 present /usr/bin/sleep | |
501 | Thu 2017\-10\-12 06:37:40 CEST 2918 1000 1000 3 present /usr/bin/cat | |
502 | Thu 2017\-10\-12 08:13:07 CEST 2955 1000 1000 3 present /usr/bin/cat | |
03c87136 | 503 | .EE |
03c87136 MK |
504 | .PP |
505 | The information shown for each core dump includes the date and time | |
506 | of the dump, the PID, UID, and GID of the dumping process, | |
507 | the signal number that caused the core dump, | |
508 | and the pathname of the executable that was being run by the dumped process. | |
509 | Various options to | |
510 | .BR coredumpctl (1) | |
511 | allow a specified coredump file to be pulled from the | |
512 | .BR systemd (1) | |
513 | location into a specified file. | |
514 | For example, to extract the core dump for PID 2955 shown above to a file named | |
1ae6b2c7 | 515 | .I core |
dc4674ac | 516 | in the current directory, one could use: |
03c87136 MK |
517 | .PP |
518 | .in +4n | |
519 | .EX | |
4818bee5 | 520 | $ \fBcoredumpctl dump 2955 \-o core\fP |
03c87136 MK |
521 | .EE |
522 | .in | |
523 | .PP | |
524 | For more extensive details, see the | |
525 | .BR coredumpctl (1) | |
526 | manual page. | |
527 | .PP | |
8626fdd2 | 528 | To (persistently) disable the |
03c87136 MK |
529 | .BR systemd (1) |
530 | mechanism that archives core dumps, restoring to something more like | |
531 | traditional Linux behavior, one can set an override for the | |
532 | .BR systemd (1) | |
533 | mechanism, using something like: | |
534 | .PP | |
94c50673 | 535 | .in +4n |
03c87136 | 536 | .EX |
94c50673 MK |
537 | # \fBecho "kernel.core_pattern=core.%p" > \e\fP |
538 | \fB /etc/sysctl.d/50\-coredump.conf\fP | |
7ef59574 | 539 | # \fB/lib/systemd/systemd\-sysctl\fP |
03c87136 MK |
540 | .EE |
541 | .in | |
542 | .PP | |
8626fdd2 | 543 | It is also possible to temporarily (i.e., until the next reboot) change the |
24581849 | 544 | .I core_pattern |
8626fdd2 MK |
545 | setting using a command such as the following |
546 | (which causes the names of core dump files to include the executable name | |
547 | as well as the number of the signal which triggered the core dump): | |
548 | .PP | |
549 | .in +4n | |
550 | .EX | |
551 | # \fBsysctl \-w kernel.core_pattern="%e\-%s.core"\fP | |
552 | .EE | |
553 | .in | |
03c87136 | 554 | .\" |
0be6f5cc | 555 | .SH NOTES |
c13182ef | 556 | The |
0be6f5cc MK |
557 | .BR gdb (1) |
558 | .I gcore | |
559 | command can be used to obtain a core dump of a running process. | |
2dad4c59 | 560 | .PP |
173e4d50 MK |
561 | In Linux versions up to and including 2.6.27, |
562 | .\" Changed with commit 6409324b385f3f63a03645b4422e3be67348d922 | |
563 | if a multithreaded process (or, more precisely, a process that | |
5ddfb8c7 MK |
564 | shares its memory with another process by being created with the |
565 | .B CLONE_VM | |
566 | flag of | |
567 | .BR clone (2)) | |
c13182ef | 568 | dumps core, then the process ID is always appended to the core filename, |
d216b211 | 569 | unless the process ID was already included elsewhere in the |
0ea48b19 MK |
570 | filename via a |
571 | .I %p | |
572 | specification in | |
5ddfb8c7 | 573 | .IR /proc/sys/kernel/core_pattern . |
173e4d50 MK |
574 | (This is primarily useful when employing the obsolete |
575 | LinuxThreads implementation, | |
b8424e6a | 576 | where each thread of a process has a different PID.) |
4b47fc34 MK |
577 | .\" Always including the PID in the name of the core file made |
578 | .\" sense for LinuxThreads, where each thread had a unique PID, | |
905e99f2 | 579 | .\" but doesn't seem to serve any purpose with NPTL, where all the |
c13182ef | 580 | .\" threads in a process share the same PID (as POSIX.1 requires). |
d9bfdb9c | 581 | .\" Probably the behavior is maintained so that applications using |
c13182ef | 582 | .\" LinuxThreads continue appending the PID (the kernel has no easy |
7fac88a9 | 583 | .\" way of telling which threading implementation the user-space |
d216b211 | 584 | .\" application is using). -- mtk, April 2006 |
a14af333 | 585 | .SH EXAMPLES |
b78e3a80 | 586 | The program below can be used to demonstrate the use of the |
a1d5601b | 587 | pipe syntax in the |
b78e3a80 MK |
588 | .I /proc/sys/kernel/core_pattern |
589 | file. | |
590 | The following shell session demonstrates the use of this program | |
591 | (compiled to create an executable named | |
592 | .IR core_pattern_pipe_test ): | |
593 | .PP | |
594 | .in +4n | |
b8302363 | 595 | .EX |
b43a3b30 MK |
596 | .RB "$" " cc \-o core_pattern_pipe_test core_pattern_pipe_test.c" |
597 | .RB "$" " su" | |
b78e3a80 | 598 | Password: |
e9b77925 | 599 | .RB "#" " echo \(dq|$PWD/core_pattern_pipe_test %p \ |
31a6818e | 600 | UID=%u GID=%g sig=%s\(dq > \e" |
b43a3b30 MK |
601 | .B " /proc/sys/kernel/core_pattern" |
602 | .RB "#" " exit" | |
603 | .RB "$" " sleep 100" | |
d064d41a | 604 | .BR "\(ha\e" " # type control\-backslash" |
b78e3a80 | 605 | Quit (core dumped) |
b43a3b30 | 606 | .RB "$" " cat core.info" |
b78e3a80 MK |
607 | argc=5 |
608 | argc[0]=</home/mtk/core_pattern_pipe_test> | |
609 | argc[1]=<20575> | |
610 | argc[2]=<UID=1000> | |
611 | argc[3]=<GID=100> | |
612 | argc[4]=<sig=3> | |
613 | Total bytes in core dump: 282624 | |
b8302363 | 614 | .EE |
b78e3a80 | 615 | .in |
9c330504 | 616 | .SS Program source |
d84d0300 | 617 | \& |
e7d0bb47 | 618 | .EX |
b78e3a80 MK |
619 | /* core_pattern_pipe_test.c */ |
620 | ||
621 | #define _GNU_SOURCE | |
622 | #include <sys/stat.h> | |
623 | #include <fcntl.h> | |
624 | #include <limits.h> | |
625 | #include <stdio.h> | |
626 | #include <stdlib.h> | |
627 | #include <unistd.h> | |
628 | ||
629 | #define BUF_SIZE 1024 | |
630 | ||
631 | int | |
632 | main(int argc, char *argv[]) | |
633 | { | |
95cc0897 | 634 | ssize_t nread, tot; |
b78e3a80 MK |
635 | char buf[BUF_SIZE]; |
636 | FILE *fp; | |
637 | char cwd[PATH_MAX]; | |
638 | ||
a1d5601b | 639 | /* Change our current working directory to that of the |
46b20ca1 | 640 | crashing process. */ |
b78e3a80 MK |
641 | |
642 | snprintf(cwd, PATH_MAX, "/proc/%s/cwd", argv[1]); | |
643 | chdir(cwd); | |
644 | ||
46b20ca1 | 645 | /* Write output to file "core.info" in that directory. */ |
b78e3a80 MK |
646 | |
647 | fp = fopen("core.info", "w+"); | |
648 | if (fp == NULL) | |
649 | exit(EXIT_FAILURE); | |
650 | ||
651 | /* Display command\-line arguments given to core_pattern | |
46b20ca1 | 652 | pipe program. */ |
b78e3a80 | 653 | |
d1a71985 | 654 | fprintf(fp, "argc=%d\en", argc); |
b42296e4 AC |
655 | for (size_t j = 0; j < argc; j++) |
656 | fprintf(fp, "argc[%zu]=<%s>\en", j, argv[j]); | |
b78e3a80 | 657 | |
46b20ca1 | 658 | /* Count bytes in standard input (the core dump). */ |
b78e3a80 MK |
659 | |
660 | tot = 0; | |
a1d5601b | 661 | while ((nread = read(STDIN_FILENO, buf, BUF_SIZE)) > 0) |
b78e3a80 | 662 | tot += nread; |
95cc0897 | 663 | fprintf(fp, "Total bytes in core dump: %zd\en", tot); |
b78e3a80 | 664 | |
aaec25cb | 665 | fclose(fp); |
b78e3a80 MK |
666 | exit(EXIT_SUCCESS); |
667 | } | |
e7d0bb47 | 668 | .EE |
0be6f5cc | 669 | .SH SEE ALSO |
a2aac039 | 670 | .BR bash (1), |
cb1b1630 | 671 | .BR coredumpctl (1), |
0be6f5cc MK |
672 | .BR gdb (1), |
673 | .BR getrlimit (2), | |
a8b32c31 | 674 | .BR mmap (2), |
0be6f5cc MK |
675 | .BR prctl (2), |
676 | .BR sigaction (2), | |
677 | .BR elf (5), | |
678 | .BR proc (5), | |
b8424e6a | 679 | .BR pthreads (7), |
a971f652 | 680 | .BR signal (7), |
4818bee5 | 681 | .BR systemd\-coredump (8) |