Changing location of core dump

Question

I want to change the default location of core dump files so that every time a core dump is generated ,it goes to that directory.Also, is it possible to save the dump file by the name of the crashed file in this location?

Marybellemarybeth

The "what happened" version: #2066412 ? – Woollen

Answer 1

Yes, it is. You can change /proc/sys/kernel/core_pattern to define the pathname used to generate the corefile. For more, see man core

example:

echo '/tmp/core_%e.%p' | sudo tee /proc/sys/kernel/core_pattern    # `tee' instead of > so that
                                                                   # opening happens in the
                                                                   # elevated process

would cause all future core dumps to be generated in /tmp and be named core_[program].[pid]

Hypocorism

+1 for the tee trick ;) Note that there is also sysctl. Then it is sysctl -w kernel.core_pattern='/tmp/core_%e.%p' – Dees

A straightforward alternative to tee is sudo bash -c "echo '/tmp/core_%e.%p' >/proc/sys/kernel/core_pattern". – Circumfluent

On arch I have no man entry for core :/ No manual entry for core in section 5 – Poisonous

@Xerus it should be there... $ pacman -Q --owns /usr/share/man/man5/core.5.gz - /usr/share/man/man5/core.5.gz is owned by man-pages 5.09-2 maybe you need to install that package? – Hypocorism

ah, I only had man installed, not man-pages, thanks :) – Poisonous

If you need to append this line in .bashrc, use echo '/tmp/core_%e.%p' | sudo tee /proc/sys/kernel/core_pattern >/dev/null instead. Otherwise scp would be broken. – Bessie

@Bessie definitely not! Don't put sudo in a .bashrc! There will always be a better way to do what you're trying to. In this case, add an entry in a /etc/sysctl.d/*.conf file or /etc/systcl.conf to make it permanent. – Hypocorism

@Hypocorism I cannot... The dev machine is under control of my company. Any modification to the system files would be reverted periodically. – Bessie

Note that on Ubuntu, the contents of /proc/sys/kernel/core_pattern are periodically overwritten by an automated process, clobbering any manual changes you may have made. Instructions on how to prevent this can be found here. – Pigling

Answer 2

Before following the instructions in the accepted answer, it could be good idea to check the contents of /proc/sys/kernel/core_pattern to see if the Redhat abrt system is in use.

-> cat /proc/sys/kernel/core_pattern
|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e

If that is in use, then you already have a pretty extensive scheme for managing core files that you would want to understand before you override it.

In a nutshell, abrt:

1. puts the core files here: /var/spool/abrt/
2. has a gui that is started with the command abrt-gui
3. augments the corefile with additional information about the failed process.
4. is configure with this file: /etc/abrt/abrt-action-save-package-data.conf

One common stumbling block with using it is to change this line in the config file:

ProcessUnpackaged = no

Change that to yes to capture core files from your homebrew processes, otherwise it will only capture corefiles from programs installed by the package manager.

[EDIT to answer how to use coredump] To examine a core dump I do this:

cd /var/spool/abrt/XXXXXXX
gdb $(cat executable) coredump

There might be a better way to so that, but gdb has served me well so I have not looked for other ways. Just replace XXXXXXX with the folder that contains your coredump file. The gdb command is cut and paste ready.

References:

Redhat Book

CentOS Forum

Rioux

thanks for this info. I got the coredump file, but how to open it with abrt ? – Shoshanashoshanna

if you are not sure about how the core file was generated, just do #file core.XYZ - this will show the command executed for generating the corefile. – Triviality

In Ubuntu since 16.04, apport is used the same way and saves dumps into /var/crash/. – Circumfluent

Answer 3

By default, a core dump file is named core or core.pid (if the file /proc/sys/kernel/core_uses_pid contains the value 1) is created in the current working directory.

But the /proc/sys/kernel/core_pattern file can be used to set to define a template that is used to name and set path for core dump files. The default value in this file is "core".

We can set the core dump file name as $ sudo sysctl -w kernel.core_pattern="/tmp/%e_core.%p" When our application crashes(say sleep), we would expect a file with the pattern of sleep_core.pid to appear under /tmp folder. Where %e is the program name and %p is the program’s PID.

Lifelike