CODEWITHSUNDEEP
linuxcrash-dumpscoredumprecovery
rogue_knight9
rogue_knight9

Reputation: 601

Changing location of core dump

I want to change the default location of core dump files so that every time a core dump is generated ,it goes to that directory.Also, is it possible to save the dump file by the name of the crashed file in this location?

Upvotes: 49

Views: 118209

Answers (3)

Disha Gugnani
Disha Gugnani

Reputation: 34

By default, a core dump file is named core or core.pid (if the file /proc/sys/kernel/core_uses_pid contains the value 1) is created in the current working directory.

But the /proc/sys/kernel/core_pattern file can be used to set to define a template that is used to name and set path for core dump files. The default value in this file is "core".

We can set the core dump file name as $ sudo sysctl -w kernel.core_pattern="/tmp/%e_core.%p" When our application crashes(say sleep), we would expect a file with the pattern of sleep_core.pid to appear under /tmp folder. Where %e is the program name and %p is the program’s PID.

Upvotes: 0

mata
mata

Reputation: 69062

Yes, it is. You can change /proc/sys/kernel/core_pattern to define the pathname used to generate the corefile. For more, see man core

example:

echo '/tmp/core_%e.%p' | sudo tee /proc/sys/kernel/core_pattern    # `tee' instead of > so that
                                                                   # opening happens in the
                                                                   # elevated process

would cause all future core dumps to be generated in /tmp and be named core_[program].[pid]

Upvotes: 84

Be Kind To New Users
Be Kind To New Users

Reputation: 10063

Before following the instructions in the accepted answer, it could be good idea to check the contents of /proc/sys/kernel/core_pattern to see if the Redhat abrt system is in use.

-> cat /proc/sys/kernel/core_pattern
|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e

If that is in use, then you already have a pretty extensive scheme for managing core files that you would want to understand before you override it.

In a nutshell, abrt:

  1. puts the core files here: /var/spool/abrt/
  2. has a gui that is started with the command abrt-gui
  3. augments the corefile with additional information about the failed process.
  4. is configure with this file: /etc/abrt/abrt-action-save-package-data.conf

One common stumbling block with using it is to change this line in the config file:

ProcessUnpackaged = no

Change that to yes to capture core files from your homebrew processes, otherwise it will only capture corefiles from programs installed by the package manager.

[EDIT to answer how to use coredump] To examine a core dump I do this:

cd /var/spool/abrt/XXXXXXX
gdb $(cat executable) coredump

There might be a better way to so that, but gdb has served me well so I have not looked for other ways. Just replace XXXXXXX with the folder that contains your coredump file. The gdb command is cut and paste ready.

References:

Redhat Book

CentOS Forum

Upvotes: 31

Related Questions