Differences between current version and revision by previous author of CoreDump.
Other diffs: Previous Major Revision, Previous Revision, or view the Annotated Edit History
| Newer page: | version 4 | Last edited on Tuesday, February 13, 2007 1:16:03 pm | by AlastairPorter | |
| Older page: | version 3 | Last edited on Sunday, March 7, 2004 3:54:52 pm | by JohnMcPherson | Revert |
@@ -1,15 +1,38 @@
-Under [Unix] style operating systems, when a program faults in some way ([SIGSEGV],[SIGABRT],etc...) and permissions allow (the [PWD] is writable, ulimit(1)'s permit), then the kernel will write out a copy of the program's address space, as well as the state of all the registers and any other state that's required to a file, usually called "core" or "core.''programname''".
+Under [Unix] style operating systems, when a program faults in some way ([SIGSEGV],[SIGABRT],etc...) and permissions allow (the [PWD|pwd(1)
] is writable, ulimit(1)'s permit), then the kernel will write out a copy of the program's address space, as well as the state of all the registers and any other state that's required to a file, usually called "core" or "core.''programname''".%%%
+To change the name of the core file on linux, look at <tt>/proc/sys/kernel/core_pattern</tt>
Programs such as gdb(1) can then parse these core files and give you some indication about /why/ the program crashed.
+<pre>
strings core | grep ^_=
+</pre>
or
+<pre>
file core
-will usually tell you what program caused the core file.
You can then use
+</pre>
+
will usually tell you what program caused the core file.
+
+<pre>
+13:06 < alastair> I tried head core
+13:06 < alastair> but gave up soon after that
+13:07 < Isomer> you kinda want tail
+13:07 < Isomer> since argv~[] is near the top of the address space, not the
+ bottom
+13:07 < Isomer> but finding argv~[] is just annoying without properly parsing
+ the entire core file
+13:08 < Isomer> so grepping the environment for the value of "_" (the current
+ command) is the easiest approach
+</pre>
+
+
You can then use
+<pre>
gdb ''program'' core
+</pre>
gdb has several commands you can use to inspect the core file, however the most useful of them is
+<pre>
(gdb) bt full
+</pre>
this will usually display enough information that a programmer can figure out why the program crashed. When emailing a bug report to a programmer about a program that crashed, including a full backtrace (as per the previous command) will greatly improve the chances that the programmer will be able to find and fix the bug you encountered.
See the DeBugging page for more information and hints about gdb.
