Core dump

Revision as of 12:20, 31 July 2014

To enable core dumps, do this in a shell:

ulimit -c unlimited

Or this from C:

#include <sys/time.h>
#include <sys/resource.h>
 
void coredump_enable(void) {
  struct rlimit rlim;
  getrlimit(RLIMIT_CORE,&rlim);
  rlim.rlim_cur = rlim.rlim_max;
  setrlimit(RLIMIT_CORE,&rlim);
}
 
void coredump_disable(void) {
  struct rlimit rlim;
  getrlimit(RLIMIT_CORE,&rlim);
  rlim.rlim_cur = 0;
  setrlimit(RLIMIT_CORE,&rlim);
}

After you call coredump_enable(), if your program dies for any reason (Segfault, etc) then a core dump will be taken. It will often be stored to ./code but the naming schema can be changed. BEWARE: once a dump has been taken, if the naming schema does not result in a unique name, then an existing dump (or file) will NOT be overwritten.

Creating a core dump

SIGQUIT is usually bound to ^\. If it's not being masked and core dumps are enabled, then you should get a dump in your current directory.

Alternatively, use kill -QUIT ${PID} or kill -ABRT ${PID}

Naming the core dumps

Run the following to see your current setting:

cat /proc/sys/kernel/core_pattern

And run the following (as root) to update it:

echo "%e.core.%s.%p" > /proc/sys/kernel/core_pattern

Putting a '|' (pipe) before an executable path and parameters from below in here allows you to run a script on a crash! That is executed before the application is killed! Be careful, that application is run as root, as a child of 'keventd'. Info

Pattern replacement

Permanent Configuration

You can add a line like this to /etc/sysctl.conf:

kernel.core_pattern = "%e.core.%s.%p"

Analyzing the dump later

Take your executable in the left hand, and the core in the right, and shove them at gdb:

gdb ${EXECUTABLE} ${COREDUMP}