matching specified characteristics. If no command is
specified, this is the implied default.</para>
+ <para>The output is designed to be human readable and contains list contains
+ a table with the following columns:</para>
+ <variablelist>
+ <varlistentry>
+ <term>TIME</term>
+ <listitem><para>The timestamp of the crash, as reported by the kernel.</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>PID</term>
+ <listitem><para>The identifier of the process that crashed.</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>UID</term>
+ <term>GID</term>
+ <listitem><para>The user and group identifiers of the process that crashed.</para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>SIGNAL</term>
+ <listitem><para>The signal that caused the process to crash, when applicable.
+ </para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>COREFILE</term>
+ <listitem><para>Information whether the coredump was stored, and whether
+ it is still accessible: <literal>none</literal> means the the core was
+ not stored, <literal>-</literal> means that it was not available (for
+ example because the process was not terminated by a signal),
+ <literal>present</literal> means that the core file is accessible by the
+ current user, <literal>journal</literal> means that the core was stored
+ in the <literal>journal</literal>, <literal>truncated</literal> is the
+ same as one of the previous two, but the core was too large and was not
+ stored in its entirety, <literal>error</literal> means that the core file
+ cannot be accessed, most likely because of insufficient permissions, and
+ <literal>missing</literal> means that the core was stored in a file, but
+ this file has since been removed.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term>EXE</term>
+ <listitem><para>The full path to the executable. For backtraces of scripts
+ this is the name of the interpreter.</para></listitem>
+ </varlistentry>
+ </variablelist>
+
<para>It's worth noting that different restrictions apply to
data saved in the journal and core dump files saved in
<filename>/var/lib/systemd/coredump</filename>, see overview in
<varlistentry>
<term><replaceable>MATCH</replaceable></term>
- <listitem><para>General journalctl predicates (see
+ <listitem><para>General journalctl predicate (see
<citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>).
- Must contain an equal sign. </para></listitem>
+ Must contain an equals sign (<literal>=</literal>).</para></listitem>
</varlistentry>
</variablelist>
</refsect1>
_cleanup_free_ char
*mid = NULL, *pid = NULL, *uid = NULL, *gid = NULL,
*sgnl = NULL, *exe = NULL, *comm = NULL, *cmdline = NULL,
- *filename = NULL, *coredump = NULL;
+ *filename = NULL, *truncated = NULL, *coredump = NULL;
const void *d;
size_t l;
usec_t t;
RETRIEVE(d, l, "COREDUMP_COMM", comm);
RETRIEVE(d, l, "COREDUMP_CMDLINE", cmdline);
RETRIEVE(d, l, "COREDUMP_FILENAME", filename);
+ RETRIEVE(d, l, "COREDUMP_TRUNCATED", truncated);
RETRIEVE(d, l, "COREDUMP", coredump);
}
format_timestamp(buf, sizeof(buf), t);
if (!had_legend && !arg_no_legend)
- fprintf(file, "%-*s %*s %*s %*s %*s %*s %s\n",
+ fprintf(file, "%-*s %*s %*s %*s %*s %-*s %s\n",
FORMAT_TIMESTAMP_WIDTH, "TIME",
6, "PID",
5, "UID",
5, "GID",
3, "SIG",
- 8, "COREFILE",
+ 9, "COREFILE",
"EXE");
normal_coredump = streq_ptr(mid, SD_MESSAGE_COREDUMP_STR);
else
present = "-";
+ if (STR_IN_SET(present, "present", "journal") && streq_ptr(truncated, "yes"))
+ present = "truncated";
+
fprintf(file, "%-*s %*s %*s %*s %*s %-*s %s\n",
FORMAT_TIMESTAMP_WIDTH, buf,
6, strna(pid),
5, strna(uid),
5, strna(gid),
3, normal_coredump ? strna(sgnl) : "-",
- 8, present,
+ 9, present,
strna(exe ?: (comm ?: cmdline)));
return 0;
*boot_id = NULL, *machine_id = NULL, *hostname = NULL,
*slice = NULL, *cgroup = NULL, *owner_uid = NULL,
*message = NULL, *timestamp = NULL, *filename = NULL,
- *coredump = NULL;
+ *truncated = NULL, *coredump = NULL;
const void *d;
size_t l;
bool normal_coredump;
RETRIEVE(d, l, "COREDUMP_CGROUP", cgroup);
RETRIEVE(d, l, "COREDUMP_TIMESTAMP", timestamp);
RETRIEVE(d, l, "COREDUMP_FILENAME", filename);
+ RETRIEVE(d, l, "COREDUMP_TRUNCATED", truncated);
RETRIEVE(d, l, "COREDUMP", coredump);
RETRIEVE(d, l, "_BOOT_ID", boot_id);
RETRIEVE(d, l, "_MACHINE_ID", machine_id);
if (hostname)
fprintf(file, " Hostname: %s\n", hostname);
- if (filename)
- fprintf(file, " Storage: %s%s\n", filename,
- access(filename, R_OK) < 0 ? " (inaccessible)" : "");
+ if (filename) {
+ bool inacc = access(filename, R_OK) < 0;
+ bool trunc = streq_ptr(truncated, "yes");
+
+ if (inacc || trunc)
+ fprintf(file, " Storage: %s%s (%s%s%s)%s\n",
+ ansi_highlight_red(),
+ filename,
+ inacc ? "inaccessible" : "",
+ inacc && trunc ? ", " : "",
+ trunc ? "truncated" : "",
+ ansi_normal());
+ else
+ fprintf(file, " Storage: %s\n", filename);
+ }
+
else if (coredump)
fprintf(file, " Storage: journal\n");
else