Get APLawrence.com by RSSControlling core files (Linux)
Author: TonyLawrence
Date: Mon Mar 14 13:53:36 2005
Subject: Controlling core files (Linux)
If you don't want core files at all, set "ulimit -c 0" in your startup files. That's the default on many systems; in /etc/profile you may find
ulimit -S -c 0 > /dev/null 2>&1
If you DO want core files, you need to reset that in your own .bash_profile:
ulimit -c 50000
would allow core files but limit them to 50,000 bytes.
You have more control of core files in /proc/sys/kernel/
For example, you can do eliminate the tagged on pid by
echo "0" > /proc/sys/kernel/core_uses_pid
Core files will then just be named "core". People do things like that so that a user can choose to put a non-writable file named "core" in directories where they don't want to generate core dumps. That could be a directory (mkdir core) or a file (touch core;chmod 000 core). I've seen it suggested that a symlink named core would redirect the dump to wherever it pointed, but I found that didn't work.
But perhaps more interesting is that you can do:
mkdir /tmp/corefiles
chmod 777 /tmp/corefiles
echo "/tmp/corefiles/core" > /proc/sys/kernel/core_pattern
All corefiles then get tossed to /tmp/corefiles (don't change core_uses_pid if you do this).
Test this with a simple script:
# script that dumps core
kill -s SIGSEGV $$
But wait, there's more (if your kernel is new enough). From "man proc":
/proc/sys/kernel/core_pattern
This file (new in Linux 2.5) provides finer control over the
form of a core filename than the obsolete
/proc/sys/kernel/core_uses_pid file described below. The name
for a core file is controlled by defining a template in
/proc/sys/kernel/core_pattern. The template can contain %
specifiers which are substituted by the following values when
a core file is created:
%% A single % character
%p PID of dumped process
%u real UID of dumped process
%g real GID of dumped process
%s number of signal causing dump
%t time of dump (secs since 0:00h, 1 Jan 1970)
%h hostname (same as the 'nodename'
returned by uname(2))
%e executable filename
A single % at the end of the template is dropped from the core
filename, as is the combination of a % followed by any character
other than those listed above. All other characters in the
template become a literal part of the core filename. The maximum
size of the resulting core filename is 64 bytes. The default
value in this file is "core". For backward compatibility, if
/proc/sys/kernel/core_pattern does not include "%p" and
/proc/sys/kernel/core_uses_pid is non-zero, then .PID will be
appended to the core filename.
Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them.
I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.
Have you tried Searching this site?
Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates
This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.
Sat Feb 9 06:57:20 2008: Subject: anonymous
This topic was really helpful to know about core files in linux/unix. Appreciated!!
Mon Jun 23 16:11:03 2008: Subject: Great article anonymous
http://www.724care.com
Ultimate guide. It does take some time to figure out why there are no core files on ubuntu. apport is not set correctly by default to handle core files in server installations. This write up is really getting to the bottom of it.
Mon Dec 8 22:18:25 2008: Subject: anonymous
I found this page via Google, and just wanted to say that I found it really useful - no need for further research. First click, and satisfied - awesome! thanks!
Mon Feb 9 05:46:55 2009: Subject: ZhichangYu
Really good guide! However It's a pity that it doesn't mention that /etc/sysctl.conf controls all settings under /proc/sys.
Mon Feb 9 12:12:45 2009: Subject: TonyLawrence
A pity?
:-)
I guess sysctl and sysctl.conf are fairly standard now but weren't when this was written. Not all distros used sysctl.conf then and I wouldn't bet my life that all do today.
I think it is probably true that sysctl.conf is a fairly safe assumption now, but more generally you should never assume that because you know something about one distro at one point in time that it applies to other distros or even that same distro at another point in time.
If you pawed through the thousands of posts here, you'd find lots of examples like that: things that were once true that aren't now, things that mention /proc but not sysctl, things that mention sysctl but not sysctl.conf, things that have changed, things that now don't work the way they did when the post was written - it's impossible for me to keep up with and that's why I REALLY APPRECIATE COMMENTS LIKE THIS.
Even when laced with pity :-)
Fri Apr 17 19:13:29 2009: Subject: Remove core files Slinky
http://slinkydiss.blogspot.com
Use this to find core files and remove them:
find . | egrep "\/core\.[0-9]+$" | xargs rm -f
This works well as it finds only core files.
Courtesy of http://www.shell-fu.org/lister.php?id=680
Fri Apr 17 19:42:12 2009: Subject: TonyLawrence
Well, sure..
But that's not what this article was about. :-)
Thu Jun 4 07:10:10 2009: Subject: DomenPuncer
From manual: "Values are in 1024-byte increments..."
so ulimit -c 50000 is about 50 MB
Thu Jun 4 10:08:55 2009: Subject: TonyLawrence
Ooops - thanks!
Fri Jun 19 04:44:19 2009: Subject: How can I store core dumps in NVRAM anonymous
This article looks informative.
Could you please tell me, how can we store core dumps in NVRAM ?
Fri Jun 19 09:26:49 2009: Subject: TonyLawrence
I can't imagine why you want to do that, but obviously you'd need th NVRAM mounted and you'd use the "/proc/sys/kernel/core_pattern" explained above.
Given the usual size of NVRAM and the overhead of filesystems, you couldn't store much..
Don't miss responses! Subscribe to Comments by RSS or by Email
Click here to add your comments
If you want a picture to show with your comment, go get a Gravatar