Naming core dump file

Linux Kernel 2.6 provides user an option to name the core dump file. User can define template in file /proc/sys/kernel/core_pattern for naming the core dump file. The template contains % specifiers that get substituted when core dump file is generated.

• %% a single % character
• %p PID of dumped process
• %u (numeric) real UID of dumped process
• %g (numeric) real GID of dumped process
• %s number of signal causing dump
• %t time of dump, expressed as seconds since the Epoch (00:00h, 1 Jan 1970, UTC)
• %h hostname (same as nodename returned by uname(2))
• %e executable filename (without path prefix)
• %c core file size soft resource limit of crashing process (since Linux 2.6.24)

Example:
I want my core dump filename look something like this signal-no_pid_exe-name_timestamp.core. On Ubuntu machine:

userOne@shangri-la:~/myTests/coredump$ su
root@shangri-la:/home/userOne/myTests/coredump# echo '%s_%p_%e_%t.core' > /proc/sys/kernel/core_pattern
root@shangri-la:/home/userOne/myTests/coredump# exit
userOne@shangri-la:~/myTests/coredump$ cat /proc/sys/kernel/core_pattern
%s_%p_%e_%t.core

After running the culprit program coredump, I got
11_12945_coredump_1274446084.core file.

Simple and nice!

Core dump

What is core dump?
Linux man page defines code dump as a disk file containing an image of process's memory at the time of termination. Core dump is result of some signals which causes a process to terminate and produce core dump file.

Signals:

1. SIGQUIT - Quit from keyboard (Is this due to CLT-C?)
   
2. SIGILL - Illegal instruction
3. SIGABRT - Abort signal
4. SIGFPE - Floating point exception
5. SIGSEGV - Invalid memory reference
6. SIGBUS - Bus error

There are several reasons in which core dump file is not produced (man core for details). But the most common reason is RLIMIT_CORE or RLIMIT_FSIZE is set to zero. ulimit command can be used to get/set the resource limit of shell.

ulimit -c unlimited

The above command will change the size of core dump file to unlimited.

By default the name of core dump file is "core". This can be configured in kernels 2.4.21 and beyond. A template can be defined in file /proc/sys/kernel/core_pattern to name the core dump file suitably.

Kernel 2.6.19 and onwards piping the core dump file to a program is possible. The file /proc/sys/kernel/core_pattern should contain pipe symbol "|" as its first character then the rest of the line is interpreted as program to be execute on core dump.

Kernel 2.6.23 and onwards lets the user to configure which memory segment are written on core dump file. The following bit mask should be defined in file /proc/PID/coredump_filter (0x3 is default value).

bit 0 Dump anonymous private mappings
bit 1 Dump anonymous shared mappings
bit 2 Dump file-backed private mappings
bit 3 Dump file-backed shared mappings

If a bit in the bit mask is set the corresponding memory is dumped.

Detailed explanation can be found in core dump man page.