Core dump

What is core dump?
Linux man page defines code dump as a disk file containing an image of process's memory at the time of termination. Core dump is result of some signals which causes a process to terminate and produce core dump file.

Signals:

1. SIGQUIT - Quit from keyboard (Is this due to CLT-C?)
   
2. SIGILL - Illegal instruction
3. SIGABRT - Abort signal
4. SIGFPE - Floating point exception
5. SIGSEGV - Invalid memory reference
6. SIGBUS - Bus error

There are several reasons in which core dump file is not produced (man core for details). But the most common reason is RLIMIT_CORE or RLIMIT_FSIZE is set to zero. ulimit command can be used to get/set the resource limit of shell.

ulimit -c unlimited

The above command will change the size of core dump file to unlimited.

By default the name of core dump file is "core". This can be configured in kernels 2.4.21 and beyond. A template can be defined in file /proc/sys/kernel/core_pattern to name the core dump file suitably.

Kernel 2.6.19 and onwards piping the core dump file to a program is possible. The file /proc/sys/kernel/core_pattern should contain pipe symbol "|" as its first character then the rest of the line is interpreted as program to be execute on core dump.

Kernel 2.6.23 and onwards lets the user to configure which memory segment are written on core dump file. The following bit mask should be defined in file /proc/PID/coredump_filter (0x3 is default value).

bit 0 Dump anonymous private mappings
bit 1 Dump anonymous shared mappings
bit 2 Dump file-backed private mappings
bit 3 Dump file-backed shared mappings

If a bit in the bit mask is set the corresponding memory is dumped.

Detailed explanation can be found in core dump man page.