View Source: CoreDump - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages

Under [Unix] style operating systems, when a program faults in some way ([SIGSEGV],[SIGABRT],etc...) and permissions allow (the [PWD|pwd(1)] is writable, ulimit(1)'s permit), then the kernel will write out a copy of the program's address space, as well as the state of all the registers and any other state that's required to a file, usually called "core" or "core.''programname''".%%%
To change the name of the core file on linux, look at <tt>/proc/sys/kernel/core_pattern</tt>

Programs such as gdb(1) can then parse these core files and give you some indication about /why/ the program crashed.
<pre>
 strings core | grep ^_=
</pre>
or
<pre>
 file core
</pre>
will usually tell you what program caused the core file.

<pre>
13:06 < alastair> I tried head core
13:06 < alastair> but gave up soon after that
13:07 < Isomer> you kinda want tail
13:07 < Isomer> since argv~[0] is near the top of the address space, not the
                bottom
13:07 < Isomer> but finding argv~[0] is just annoying without properly parsing
                the entire core file
13:08 < Isomer> so grepping the environment for the value of "_" (the current
                command) is the easiest approach
</pre>

You can then use
<pre>
 gdb ''program'' core
</pre>

gdb has several commands you can use to inspect the core file, however the most useful of them is
<pre>
 (gdb) bt full
</pre>

this will usually display enough information that a programmer can figure out why the program crashed.  When emailing a bug report to a programmer about a program that crashed, including a full backtrace (as per the previous command) will greatly improve the chances that the programmer will be able to find and fix the bug you encountered.

See the DeBugging page for more information and hints about gdb.

3 pages link to CoreDump:

Last edited on Tuesday, February 13, 2007 1:16:03 pm by AlastairPorter

Edit PageHistory Diff Info LikePages