]>
Commit | Line | Data |
---|---|---|
b78e3a80 | 1 | .\" Copyright (c) 2006, 2008 by Michael Kerrisk <mtk.manpages@gmail.com> |
0be6f5cc | 2 | .\" |
93015253 | 3 | .\" %%%LICENSE_START(VERBATIM) |
0be6f5cc MK |
4 | .\" Permission is granted to make and distribute verbatim copies of this |
5 | .\" manual provided the copyright notice and this permission notice are | |
6 | .\" preserved on all copies. | |
7 | .\" | |
8 | .\" Permission is granted to copy and distribute modified versions of this | |
9 | .\" manual under the conditions for verbatim copying, provided that the | |
10 | .\" entire resulting derived work is distributed under the terms of a | |
11 | .\" permission notice identical to this one. | |
12 | .\" | |
13 | .\" Since the Linux kernel and libraries are constantly changing, this | |
14 | .\" manual page may be incorrect or out-of-date. The author(s) assume no | |
15 | .\" responsibility for errors or omissions, or for damages resulting from | |
10d76543 MK |
16 | .\" the use of the information contained herein. The author(s) may not |
17 | .\" have taken the same level of care in the production of this manual, | |
18 | .\" which is licensed free of charge, as they might when working | |
19 | .\" professionally. | |
0be6f5cc MK |
20 | .\" |
21 | .\" Formatted or processed versions of this manual, if unaccompanied by | |
22 | .\" the source, must acknowledge the copyright and authors of this work. | |
4b72fb64 | 23 | .\" %%%LICENSE_END |
0be6f5cc | 24 | .\" |
4b8c67d9 | 25 | .TH CORE 5 2017-09-15 "Linux" "Linux Programmer's Manual" |
0be6f5cc MK |
26 | .SH NAME |
27 | core \- core dump file | |
28 | .SH DESCRIPTION | |
c13182ef | 29 | The default action of certain signals is to cause a process to terminate |
0be6f5cc MK |
30 | and produce a |
31 | .IR "core dump file" , | |
c13182ef | 32 | a disk file containing an image of the process's memory at |
0be6f5cc | 33 | the time of termination. |
78890124 MK |
34 | This image can be used in a debugger (e.g., |
35 | .BR gdb (1)) | |
36 | to inspect the state of the program at the time that it terminated. | |
0be6f5cc MK |
37 | A list of the signals which cause a process to dump core can be found in |
38 | .BR signal (7). | |
2dad4c59 | 39 | .PP |
53cd945e | 40 | A process can set its soft |
0daa9e92 | 41 | .B RLIMIT_CORE |
c13182ef | 42 | resource limit to place an upper limit on the size of the core dump file |
0be6f5cc MK |
43 | that will be produced if it receives a "core dump" signal; see |
44 | .BR getrlimit (2) | |
45 | for details. | |
2dad4c59 | 46 | .PP |
c13182ef | 47 | There are various circumstances in which a core dump file is |
0be6f5cc | 48 | not produced: |
e256d8aa | 49 | .IP * 3 |
67ed0e4b | 50 | The process does not have permission to write the core file. |
91aabea5 | 51 | (By default, the core file is called |
ab0f60c6 MK |
52 | .IR core |
53 | or | |
54 | .IR core.pid , | |
55 | where | |
56 | .I pid | |
57 | is the ID of the process that dumped core, | |
c13182ef | 58 | and is created in the current working directory. |
67ed0e4b | 59 | See below for details on naming.) |
a23d8efa | 60 | Writing the core file fails if the directory in which |
24b74457 | 61 | it is to be created is nonwritable, |
c13182ef | 62 | or if a file with the same name exists and |
67ed0e4b | 63 | is not writable |
c13182ef | 64 | or is not a regular file |
67ed0e4b | 65 | (e.g., it is a directory or a symbolic link). |
e256d8aa | 66 | .IP * |
c13182ef MK |
67 | A (writable, regular) file with the same name as would be used for the |
68 | core dump already exists, but there is more than one hard link to that | |
10cd859a MK |
69 | file. |
70 | .IP * | |
9ee4a2b6 | 71 | The filesystem where the core dump file would be created is full; |
972a8ec7 | 72 | or has run out of inodes; or is mounted read-only; |
9ee4a2b6 | 73 | or the user has reached their quota for the filesystem. |
10cd859a | 74 | .IP * |
c13182ef | 75 | The directory in which the core dump file is to be created does |
67ed0e4b | 76 | not exist. |
0be6f5cc | 77 | .IP * |
78890124 | 78 | The |
0be6f5cc | 79 | .B RLIMIT_CORE |
78890124 | 80 | (core file size) or |
0be6f5cc | 81 | .B RLIMIT_FSIZE |
78890124 MK |
82 | (file size) resource limits for the process are set to zero; see |
83 | .BR getrlimit (2) | |
84 | and the documentation of the shell's | |
85 | .I ulimit | |
86 | command | |
87 | .RI ( limit | |
88 | in | |
89 | .BR csh (1)). | |
0be6f5cc | 90 | .IP * |
c13182ef | 91 | The binary being executed by the process does not have read |
0be6f5cc MK |
92 | permission enabled. |
93 | .IP * | |
94 | The process is executing a set-user-ID (set-group-ID) program | |
c13182ef | 95 | that is owned by a user (group) other than the real user (group) |
60a119dd MK |
96 | ID of the process, |
97 | or the process is executing a program that has file capabilities (see | |
98 | .BR capabilities (7)). | |
0be6f5cc MK |
99 | (However, see the description of the |
100 | .BR prctl (2) | |
101 | .B PR_SET_DUMPABLE | |
102 | operation, and the description of the | |
103 | .I /proc/sys/fs/suid_dumpable | |
14523015 MK |
104 | .\" FIXME . Perhaps relocate discussion of /proc/sys/fs/suid_dumpable |
105 | .\" and PR_SET_DUMPABLE to this page? | |
0be6f5cc MK |
106 | file in |
107 | .BR proc (5).) | |
d298e17f | 108 | .IP * |
6c3d8859 MK |
109 | .I /proc/sys/kernel/core_pattern |
110 | is empty and | |
111 | .I /proc/sys/kernel/core_uses_pid | |
112 | contains the value 0. | |
113 | (These files are described below.) | |
114 | Note that if | |
115 | .I /proc/sys/kernel/core_pattern | |
116 | is empty and | |
117 | .I /proc/sys/kernel/core_uses_pid | |
118 | contains the value 1, | |
119 | core dump files will have names of the form | |
120 | .IR .pid , | |
121 | and such files are hidden unless one uses the | |
122 | .BR ls (1) | |
123 | .I -a | |
124 | option. | |
125 | .IP * | |
d298e17f MK |
126 | (Since Linux 3.7) |
127 | .\" commit 046d662f481830e652ac34cd112249adde16452a | |
128 | The kernel was configured without the | |
129 | .BR CONFIG_COREDUMP | |
130 | option. | |
0ac3f06f MK |
131 | .PP |
132 | In addition, | |
133 | a core dump may exclude part of the address space of the process if the | |
134 | .BR madvise (2) | |
135 | .B MADV_DONTDUMP | |
136 | flag was employed. | |
03c87136 MK |
137 | .PP |
138 | On systems that employ | |
139 | .BR systemd (1) | |
140 | as the | |
141 | .I init | |
142 | framework, core dumps may instead be placed in a location determined by | |
143 | .BR systemd (1). | |
144 | See below for further details. | |
145 | .\" | |
0be6f5cc | 146 | .SS Naming of core dump files |
c13182ef | 147 | By default, a core dump file is named |
0be6f5cc | 148 | .IR core , |
c13182ef | 149 | but the |
0be6f5cc | 150 | .I /proc/sys/kernel/core_pattern |
b78e3a80 | 151 | file (since Linux 2.6 and 2.4.21) |
0be6f5cc MK |
152 | can be set to define a template that is used to name core dump files. |
153 | The template can contain % specifiers which are substituted | |
154 | by the following values when a core file is created: | |
b78e3a80 MK |
155 | .PP |
156 | .RS 4 | |
157 | .PD 0 | |
158 | .TP 4 | |
159 | %% | |
160 | a single % character | |
161 | .TP | |
b9ed1fbb MK |
162 | %c |
163 | core file size soft resource limit of crashing process (since Linux 2.6.24) | |
b78e3a80 | 164 | .TP |
23ed8402 | 165 | %d |
fd9c713b MK |
166 | .\" Added in git commit 12a2b4b2241e318b4f6df31228e4272d2c2968a1 |
167 | dump mode\(emsame as value returned by | |
168 | .BR prctl (2) | |
169 | .B PR_GET_DUMPABLE | |
23ed8402 MF |
170 | (since Linux 3.7) |
171 | .TP | |
b78e3a80 MK |
172 | %e |
173 | executable filename (without path prefix) | |
174 | .TP | |
d7e34031 MK |
175 | %E |
176 | pathname of executable, | |
c46d3d7a BW |
177 | with slashes (\(aq/\(aq) replaced by exclamation marks (\(aq!\(aq) |
178 | (since Linux 3.0). | |
d7e34031 | 179 | .TP |
b9ed1fbb MK |
180 | %g |
181 | (numeric) real GID of dumped process | |
182 | .TP | |
183 | %h | |
184 | hostname (same as \fInodename\fP returned by \fBuname\fP(2)) | |
185 | .TP | |
e04ae86d MK |
186 | %i |
187 | TID of thread that triggered core dump, | |
188 | as seen in the PID namespace in which the thread resides | |
189 | .\" commit b03023ecbdb76c1dec86b41ed80b123c22783220 | |
190 | (since Linux 3.18) | |
191 | .TP | |
192 | %I | |
193 | TID of thread that triggered core dump, as seen in the initial PID namespace | |
194 | .\" commit b03023ecbdb76c1dec86b41ed80b123c22783220 | |
195 | (since Linux 3.18) | |
196 | .TP | |
b9ed1fbb MK |
197 | %p |
198 | PID of dumped process, | |
199 | as seen in the PID namespace in which the process resides | |
200 | .TP | |
7629685c | 201 | %P |
b9ed1fbb MK |
202 | .\" Added in git commit 65aafb1e7484b7434a0c1d4c593191ebe5776a2f |
203 | PID of dumped process, as seen in the initial PID namespace | |
204 | (since Linux 3.12) | |
205 | .TP | |
206 | %s | |
207 | number of signal causing dump | |
208 | .TP | |
209 | %t | |
210 | time of dump, expressed as seconds since the | |
211 | Epoch, 1970-01-01 00:00:00 +0000 (UTC) | |
212 | .TP | |
213 | %u | |
214 | (numeric) real UID of dumped process | |
b78e3a80 MK |
215 | .PD |
216 | .RE | |
217 | .PP | |
c13182ef MK |
218 | A single % at the end of the template is dropped from the |
219 | core filename, as is the combination of a % followed by any | |
0be6f5cc MK |
220 | character other than those listed above. |
221 | All other characters in the template become a literal | |
222 | part of the core filename. | |
f81fb444 | 223 | The template may include \(aq/\(aq characters, which are interpreted |
0be6f5cc | 224 | as delimiters for directory names. |
b78e3a80 MK |
225 | The maximum size of the resulting core filename is 128 bytes (64 bytes |
226 | in kernels before 2.6.19). | |
0be6f5cc MK |
227 | The default value in this file is "core". |
228 | For backward compatibility, if | |
229 | .I /proc/sys/kernel/core_pattern | |
0ea48b19 MK |
230 | does not include |
231 | .I %p | |
232 | and | |
0be6f5cc MK |
233 | .I /proc/sys/kernel/core_uses_pid |
234 | (see below) | |
c7094399 | 235 | is nonzero, then .PID will be appended to the core filename. |
2dad4c59 | 236 | .PP |
5c3ce796 MF |
237 | Paths are interpreted according to the settings that are active for the |
238 | crashing process. | |
4389c7ab MK |
239 | That means the crashing process's mount namespace (see |
240 | .BR mount_namespaces (7)), | |
241 | its current working directory (found via | |
5c3ce796 | 242 | .BR getcwd (2)), |
4389c7ab MK |
243 | and its root directory (see |
244 | .BR chroot (2)). | |
2dad4c59 | 245 | .PP |
10cd859a MK |
246 | Since version 2.4, Linux has also provided |
247 | a more primitive method of controlling | |
0be6f5cc MK |
248 | the name of the core dump file. |
249 | If the | |
250 | .I /proc/sys/kernel/core_uses_pid | |
251 | file contains the value 0, then a core dump file is simply named | |
252 | .IR core . | |
c7094399 | 253 | If this file contains a nonzero value, then the core dump file includes |
0be6f5cc MK |
254 | the process ID in a name of the form |
255 | .IR core.PID . | |
2dad4c59 | 256 | .PP |
4b749a12 | 257 | Since Linux 3.6, |
8c897fc6 KC |
258 | .\" 9520628e8ceb69fa9a4aee6b57f22675d9e1b709 |
259 | if | |
260 | .I /proc/sys/fs/suid_dumpable | |
4b749a12 | 261 | is set to 2 ("suidsafe"), the pattern must be either an absolute pathname |
8c897fc6 | 262 | (starting with a leading \(aq/\(aq character) or a pipe, as defined below. |
b78e3a80 MK |
263 | .SS Piping core dumps to a program |
264 | Since kernel 2.6.19, Linux supports an alternate syntax for the | |
265 | .I /proc/sys/kernel/core_pattern | |
266 | file. | |
267 | If the first character of this file is a pipe symbol (\fB|\fP), | |
aee42577 | 268 | then the remainder of the line is interpreted as the command-line for |
df525461 | 269 | a user-space program (or script) that is to be executed. |
b78e3a80 MK |
270 | Instead of being written to a disk file, the core dump is given as |
271 | standard input to the program. | |
272 | Note the following points: | |
273 | .IP * 3 | |
274 | The program must be specified using an absolute pathname (or a | |
275 | pathname relative to the root directory, \fI/\fP), | |
276 | and must immediately follow the '|' character. | |
277 | .IP * | |
089527aa MK |
278 | The command-line arguments can include any of |
279 | the % specifiers listed above. | |
280 | For example, to pass the PID of the process that is being dumped, specify | |
281 | .I %p | |
282 | in an argument. | |
5c3ce796 | 283 | .IP * |
b78e3a80 MK |
284 | The process created to run the program runs as user and group |
285 | .IR root . | |
286 | .IP * | |
5c3ce796 MF |
287 | Running as |
288 | .I root | |
289 | does not confer any exceptional security bypasses. | |
4389c7ab | 290 | Namely, LSMs (e.g., SELinux) are still active and may prevent the handler |
5c3ce796 | 291 | from accessing details about the crashed process via |
4389c7ab | 292 | .IR /proc/[pid] . |
5c3ce796 | 293 | .IP * |
089527aa MK |
294 | The program pathname is interpreted with respect to the initial mount namespace |
295 | as it is always executed there. | |
296 | It is not affected by the settings | |
297 | (e.g., root directory, mount namespace, current working directory) | |
298 | of the crashing process. | |
299 | .IP * | |
1c3aae54 MK |
300 | The process runs in the initial namespaces |
301 | (PID, mount, user, and so on) | |
5c3ce796 | 302 | and not in the namespaces of the crashing process. |
4389c7ab | 303 | One can utilize specifiers such as |
5c3ce796 MF |
304 | .I %P |
305 | to find the right | |
4389c7ab | 306 | .I /proc/[pid] |
5c3ce796 MF |
307 | directory and probe/enter the crashing process's namespaces if needed. |
308 | .IP * | |
9d8b2250 MK |
309 | The process starts with its current working directory |
310 | as the root directory. | |
311 | If desired, it is possible change to the working directory of | |
312 | the dumping process by employing the value provided by the | |
313 | .I %P | |
314 | specifier to change to the location of the dumping process via | |
315 | .IR /proc/[pid]/cwd . | |
316 | .IP * | |
b78e3a80 | 317 | Command-line arguments can be supplied to the |
d26a34f0 | 318 | program (since Linux 2.6.24), |
b78e3a80 | 319 | delimited by white space (up to a total line length of 128 bytes). |
97839a76 MK |
320 | .IP * |
321 | The | |
322 | .B RLIMIT_CORE | |
323 | limit is not enforced for core dumps that are piped to a program | |
324 | via this mechanism. | |
d9f2d36a MK |
325 | .\" |
326 | .SS /proc/sys/kernel/core_pipe_limit | |
327 | When collecting core dumps via a pipe to a user-space program, | |
328 | it can be useful for the collecting program to gather data about | |
329 | the crashing process from that process's | |
750653a8 | 330 | .IR /proc/[pid] |
d9f2d36a MK |
331 | directory. |
332 | In order to do this safely, | |
333 | the kernel must wait for the program collecting the core dump to exit, | |
334 | so as not to remove the crashing process's | |
750653a8 | 335 | .IR /proc/[pid] |
d9f2d36a MK |
336 | files prematurely. |
337 | This in turn creates the | |
338 | possibility that a misbehaving collecting program can block | |
339 | the reaping of a crashed process by simply never exiting. | |
2dad4c59 | 340 | .PP |
d9f2d36a MK |
341 | Since Linux 2.6.32, |
342 | .\" commit a293980c2e261bd5b0d2a77340dd04f684caff58 | |
343 | the | |
344 | .I /proc/sys/kernel/core_pipe_limit | |
345 | can be used to defend against this possibility. | |
346 | The value in this file defines how many concurrent crashing | |
347 | processes may be piped to user-space programs in parallel. | |
348 | If this value is exceeded, then those crashing processes above this value | |
349 | are noted in the kernel log and their core dumps are skipped. | |
2dad4c59 | 350 | .PP |
d9f2d36a MK |
351 | A value of 0 in this file is special. |
352 | It indicates that unlimited processes may be captured in parallel, | |
353 | but that no waiting will take place (i.e., the collecting | |
354 | program is not guaranteed access to | |
355 | .IR /proc/<crashing-PID> ). | |
356 | The default value for this file is 0. | |
357 | .\" | |
b78e3a80 MK |
358 | .SS Controlling which mappings are written to the core dump |
359 | Since kernel 2.6.23, the Linux-specific | |
750653a8 | 360 | .IR /proc/[pid]/coredump_filter |
b78e3a80 MK |
361 | file can be used to control which memory segments are written to the |
362 | core dump file in the event that a core dump is performed for the | |
363 | process with the corresponding process ID. | |
2dad4c59 | 364 | .PP |
b78e3a80 MK |
365 | The value in the file is a bit mask of memory mapping types (see |
366 | .BR mmap (2)). | |
367 | If a bit is set in the mask, then memory mappings of the | |
368 | corresponding type are dumped; otherwise they are not dumped. | |
369 | The bits in this file have the following meanings: | |
370 | .PP | |
371 | .PD 0 | |
372 | .RS 4 | |
373 | .TP | |
374 | bit 0 | |
375 | Dump anonymous private mappings. | |
376 | .TP | |
377 | bit 1 | |
378 | Dump anonymous shared mappings. | |
379 | .TP | |
380 | bit 2 | |
381 | Dump file-backed private mappings. | |
382 | .TP | |
383 | bit 3 | |
384 | Dump file-backed shared mappings. | |
385 | .\" file-backed shared mappings of course also update the underlying | |
386 | .\" mapped file. | |
cd3c7b38 MK |
387 | .TP |
388 | bit 4 (since Linux 2.6.24) | |
bb464ec1 | 389 | Dump ELF headers. |
cd3c7b38 MK |
390 | .TP |
391 | bit 5 (since Linux 2.6.28) | |
392 | Dump private huge pages. | |
393 | .TP | |
394 | bit 6 (since Linux 2.6.28) | |
395 | Dump shared huge pages. | |
db02982a RZ |
396 | .TP |
397 | bit 7 (since Linux 4.4) | |
9242ecfe | 398 | .\" commit ab27a8d04b32b6ee8c30c14c4afd1058e8addc82 |
db02982a RZ |
399 | Dump private DAX pages. |
400 | .TP | |
401 | bit 8 (since Linux 4.4) | |
9242ecfe | 402 | .\" commit ab27a8d04b32b6ee8c30c14c4afd1058e8addc82 |
db02982a | 403 | Dump shared DAX pages. |
b78e3a80 MK |
404 | .RE |
405 | .PD | |
406 | .PP | |
cd3c7b38 MK |
407 | By default, the following bits are set: 0, 1, 4 (if the |
408 | .B CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS | |
409 | kernel configuration option is enabled), and 5. | |
7b28cf66 MK |
410 | This default can be modified at boot time using the |
411 | .I coredump_filter | |
412 | boot option. | |
2dad4c59 | 413 | .PP |
cd3c7b38 MK |
414 | The value of this file is displayed in hexadecimal. |
415 | (The default value is thus displayed as 33.) | |
2dad4c59 | 416 | .PP |
a1d5601b | 417 | Memory-mapped I/O pages such as frame buffer are never dumped, and |
0f0713a4 MK |
418 | virtual DSO |
419 | .RB ( vdso (7)) | |
420 | pages are always dumped, regardless of the | |
b78e3a80 MK |
421 | .I coredump_filter |
422 | value. | |
2dad4c59 | 423 | .PP |
b78e3a80 MK |
424 | A child process created via |
425 | .BR fork (2) | |
70d70ddc | 426 | inherits its parent's |
b78e3a80 MK |
427 | .I coredump_filter |
428 | value; | |
a1d5601b | 429 | the |
b78e3a80 MK |
430 | .I coredump_filter |
431 | value is preserved across an | |
432 | .BR execve (2). | |
2dad4c59 | 433 | .PP |
b78e3a80 MK |
434 | It can be useful to set |
435 | .I coredump_filter | |
436 | in the parent shell before running a program, for example: | |
2dad4c59 | 437 | .PP |
b78e3a80 | 438 | .in +4n |
b8302363 | 439 | .EX |
b43a3b30 MK |
440 | .RB "$" " echo 0x7 > /proc/self/coredump_filter" |
441 | .RB "$" " ./some_program" | |
b8302363 | 442 | .EE |
b78e3a80 MK |
443 | .in |
444 | .PP | |
33a0ccb2 | 445 | This file is provided only if the kernel was built with the |
e242920a MK |
446 | .B CONFIG_ELF_CORE |
447 | configuration option. | |
03c87136 MK |
448 | .\" |
449 | .SS Core dumps and systemd | |
450 | On systems using the | |
451 | .BR systemd (1) | |
452 | .I init | |
453 | framework, core dumps may be placed in a location determined by | |
454 | .BR systemd (1). | |
455 | To do this, | |
456 | .BR systemd (1) | |
457 | employs the | |
458 | .I core_pattern | |
dc4674ac | 459 | feature that allows piping core dumps to a program. |
03c87136 MK |
460 | One can verify this by checking whether core dumps are being piped to the |
461 | .BR systemd-coredump (8) | |
462 | program: | |
463 | .PP | |
464 | .in +4n | |
465 | .EX | |
466 | $ \fBcat /proc/sys/kernel/core_pattern\fP | |
467 | |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %e | |
468 | .EE | |
469 | .in | |
470 | .PP | |
471 | In this case, core dumps will be placed in the location configured for | |
472 | .BR systemd-coredump (8), | |
473 | typically as | |
474 | .BR lz4 (1) | |
475 | compressed files in the directory | |
476 | .IR /var/lib/systemd/coredump/ . | |
477 | One can list the core dumps that have been recorded by | |
478 | .BR systemd-coredump (8) | |
479 | using | |
480 | .BR coredumpctl (1): | |
481 | .PP | |
6e3b05fe | 482 | .in +2n |
03c87136 MK |
483 | .EX |
484 | $ \fBcoredumpctl list | tail -5\fP | |
485 | Wed 2017-10-11 22:25:30 CEST 2748 1000 1000 3 present /usr/bin/sleep | |
486 | Thu 2017-10-12 06:29:10 CEST 2716 1000 1000 3 present /usr/bin/sleep | |
487 | Thu 2017-10-12 06:30:50 CEST 2767 1000 1000 3 present /usr/bin/sleep | |
488 | Thu 2017-10-12 06:37:40 CEST 2918 1000 1000 3 present /usr/bin/cat | |
489 | Thu 2017-10-12 08:13:07 CEST 2955 1000 1000 3 present /usr/bin/cat | |
490 | .EE | |
491 | .in | |
492 | .PP | |
493 | The information shown for each core dump includes the date and time | |
494 | of the dump, the PID, UID, and GID of the dumping process, | |
495 | the signal number that caused the core dump, | |
496 | and the pathname of the executable that was being run by the dumped process. | |
497 | Various options to | |
498 | .BR coredumpctl (1) | |
499 | allow a specified coredump file to be pulled from the | |
500 | .BR systemd (1) | |
501 | location into a specified file. | |
502 | For example, to extract the core dump for PID 2955 shown above to a file named | |
503 | .IR core | |
dc4674ac | 504 | in the current directory, one could use: |
03c87136 MK |
505 | .PP |
506 | .in +4n | |
507 | .EX | |
508 | $ \fBcoredumpctl dump 2955 -o core\fP | |
509 | .EE | |
510 | .in | |
511 | .PP | |
512 | For more extensive details, see the | |
513 | .BR coredumpctl (1) | |
514 | manual page. | |
515 | .PP | |
516 | To disable the | |
517 | .BR systemd (1) | |
518 | mechanism that archives core dumps, restoring to something more like | |
519 | traditional Linux behavior, one can set an override for the | |
520 | .BR systemd (1) | |
521 | mechanism, using something like: | |
522 | .PP | |
523 | .in +2n | |
524 | .EX | |
525 | # echo "kernel.core_pattern=core.%p" > /etc/sysctl.d/50-coredump.conf | |
526 | # /lib/systemd/systemd-sysctl | |
527 | .EE | |
528 | .in | |
529 | .PP | |
530 | .\" | |
0be6f5cc | 531 | .SH NOTES |
c13182ef | 532 | The |
0be6f5cc MK |
533 | .BR gdb (1) |
534 | .I gcore | |
535 | command can be used to obtain a core dump of a running process. | |
2dad4c59 | 536 | .PP |
173e4d50 MK |
537 | In Linux versions up to and including 2.6.27, |
538 | .\" Changed with commit 6409324b385f3f63a03645b4422e3be67348d922 | |
539 | if a multithreaded process (or, more precisely, a process that | |
5ddfb8c7 MK |
540 | shares its memory with another process by being created with the |
541 | .B CLONE_VM | |
542 | flag of | |
543 | .BR clone (2)) | |
c13182ef | 544 | dumps core, then the process ID is always appended to the core filename, |
d216b211 | 545 | unless the process ID was already included elsewhere in the |
0ea48b19 MK |
546 | filename via a |
547 | .I %p | |
548 | specification in | |
5ddfb8c7 | 549 | .IR /proc/sys/kernel/core_pattern . |
173e4d50 MK |
550 | (This is primarily useful when employing the obsolete |
551 | LinuxThreads implementation, | |
b8424e6a | 552 | where each thread of a process has a different PID.) |
4b47fc34 MK |
553 | .\" Always including the PID in the name of the core file made |
554 | .\" sense for LinuxThreads, where each thread had a unique PID, | |
905e99f2 | 555 | .\" but doesn't seem to serve any purpose with NPTL, where all the |
c13182ef | 556 | .\" threads in a process share the same PID (as POSIX.1 requires). |
d9bfdb9c | 557 | .\" Probably the behavior is maintained so that applications using |
c13182ef | 558 | .\" LinuxThreads continue appending the PID (the kernel has no easy |
7fac88a9 | 559 | .\" way of telling which threading implementation the user-space |
d216b211 | 560 | .\" application is using). -- mtk, April 2006 |
b78e3a80 MK |
561 | .SH EXAMPLE |
562 | The program below can be used to demonstrate the use of the | |
a1d5601b | 563 | pipe syntax in the |
b78e3a80 MK |
564 | .I /proc/sys/kernel/core_pattern |
565 | file. | |
566 | The following shell session demonstrates the use of this program | |
567 | (compiled to create an executable named | |
568 | .IR core_pattern_pipe_test ): | |
569 | .PP | |
570 | .in +4n | |
b8302363 | 571 | .EX |
b43a3b30 MK |
572 | .RB "$" " cc \-o core_pattern_pipe_test core_pattern_pipe_test.c" |
573 | .RB "$" " su" | |
b78e3a80 | 574 | Password: |
e9b77925 | 575 | .RB "#" " echo \(dq|$PWD/core_pattern_pipe_test %p \ |
31a6818e | 576 | UID=%u GID=%g sig=%s\(dq > \e" |
b43a3b30 MK |
577 | .B " /proc/sys/kernel/core_pattern" |
578 | .RB "#" " exit" | |
579 | .RB "$" " sleep 100" | |
31a6818e | 580 | .BR "^\e" " # type control-backslash" |
b78e3a80 | 581 | Quit (core dumped) |
b43a3b30 | 582 | .RB "$" " cat core.info" |
b78e3a80 MK |
583 | argc=5 |
584 | argc[0]=</home/mtk/core_pattern_pipe_test> | |
585 | argc[1]=<20575> | |
586 | argc[2]=<UID=1000> | |
587 | argc[3]=<GID=100> | |
588 | argc[4]=<sig=3> | |
589 | Total bytes in core dump: 282624 | |
b8302363 | 590 | .EE |
b78e3a80 | 591 | .in |
9c330504 | 592 | .SS Program source |
d84d0300 | 593 | \& |
e7d0bb47 | 594 | .EX |
b78e3a80 MK |
595 | /* core_pattern_pipe_test.c */ |
596 | ||
597 | #define _GNU_SOURCE | |
598 | #include <sys/stat.h> | |
599 | #include <fcntl.h> | |
600 | #include <limits.h> | |
601 | #include <stdio.h> | |
602 | #include <stdlib.h> | |
603 | #include <unistd.h> | |
604 | ||
605 | #define BUF_SIZE 1024 | |
606 | ||
607 | int | |
608 | main(int argc, char *argv[]) | |
609 | { | |
610 | int tot, j; | |
611 | ssize_t nread; | |
612 | char buf[BUF_SIZE]; | |
613 | FILE *fp; | |
614 | char cwd[PATH_MAX]; | |
615 | ||
a1d5601b | 616 | /* Change our current working directory to that of the |
b78e3a80 MK |
617 | crashing process */ |
618 | ||
619 | snprintf(cwd, PATH_MAX, "/proc/%s/cwd", argv[1]); | |
620 | chdir(cwd); | |
621 | ||
622 | /* Write output to file "core.info" in that directory */ | |
623 | ||
624 | fp = fopen("core.info", "w+"); | |
625 | if (fp == NULL) | |
626 | exit(EXIT_FAILURE); | |
627 | ||
628 | /* Display command\-line arguments given to core_pattern | |
629 | pipe program */ | |
630 | ||
631 | fprintf(fp, "argc=%d\\n", argc); | |
632 | for (j = 0; j < argc; j++) | |
633 | fprintf(fp, "argc[%d]=<%s>\\n", j, argv[j]); | |
634 | ||
635 | /* Count bytes in standard input (the core dump) */ | |
636 | ||
637 | tot = 0; | |
a1d5601b | 638 | while ((nread = read(STDIN_FILENO, buf, BUF_SIZE)) > 0) |
b78e3a80 MK |
639 | tot += nread; |
640 | fprintf(fp, "Total bytes in core dump: %d\\n", tot); | |
641 | ||
aaec25cb | 642 | fclose(fp); |
b78e3a80 MK |
643 | exit(EXIT_SUCCESS); |
644 | } | |
e7d0bb47 | 645 | .EE |
0be6f5cc | 646 | .SH SEE ALSO |
a2aac039 | 647 | .BR bash (1), |
cb1b1630 | 648 | .BR coredumpctl (1), |
0be6f5cc MK |
649 | .BR gdb (1), |
650 | .BR getrlimit (2), | |
a8b32c31 | 651 | .BR mmap (2), |
0be6f5cc MK |
652 | .BR prctl (2), |
653 | .BR sigaction (2), | |
654 | .BR elf (5), | |
655 | .BR proc (5), | |
b8424e6a | 656 | .BR pthreads (7), |
a971f652 MK |
657 | .BR signal (7), |
658 | .BR systemd-coredump (8) |