Linux Core Dump Without Killing Process

Question

Is it possible to generate a core dump without killing the process? If so, what is the command/signal to do so?

Thanks, Jim

Secrest

Answer 1

See the 'gcore' command, part of GDB.

Pustulate

This looks promising. I got core file this way. However, the process I'm analyzing terminates as soon as I detach gdb from it. It also terminates immediately if I strace it. Do you know any way to prevent it from detecting that it's getting attached by gdb/strace? Thanks again! – Secrest

You can run gcore against the process and then gdb against the dumped core. Like: "gcore 12345; gdb /path/to/binary core.12345" – Hammurabi

Answer 2

I had the best success with attaching gdb in batch mode to the running program, get a backtrace and then detach.

gdb --batch --quiet -ex "set pagination off" -ex "thread apply all bt"
-ex "detach" -ex "quit" pid pid_of_process

Bekki

but backtrace is not a coredump – Probabilism

You may obtain the backtrace from a coredump. – Tooling

Answer 3

A method to generate a coredump directly from program without gdb is described here: https://unix.stackexchange.com/questions/11185/dump-process-core-without-killing-the-process

It make sense only if you are developing. Principle is to fork program and to raise SIGABRT from child.

Sidon