What is core?

In Linux, when a program crashes abnormally, the operating system stores the memory status and call stack information of the program at that time in core files. This behavior is called core dump. Core files generally store register information (including program Pointers, stack Pointers, etc.), memory management information, CPU and operating system state and function call stack information. Therefore, core files are very important for developers, and many times we need to rely on the analysis of core files and logs to locate and resolve crashes.

Core dump Settings

On Linux, core dump can be set to:

  • Run the ulimit -c command. If the query result is 0, the core dump function is disabled.
  • Disable: ulimit -c 0.
  • Enable: ulimit -c unlimited: The number of core files that can be used is unlimited. The unit is BLOCKS. For example, ulimit -c 100 indicates that the number of core files that can be used is 100 kB.
  • To change the core file name generation rule, run the echo 1 > /proc/sys/kernel/core_uses_pid command to change the name of the generated core file to core.pid. By default, core dump generates a file named core in the program’s current directory. And the new core overwrites the existing core.
  • Change the generation path and file name: You can control the saving location and file format of core files by changing **/proc/sys/kernel/core_pattern. For example, run the echo “/ TMP /corefile/core-%e-%p-%t” > /proc/sys/kernel/core_pattern** command to save the corefile to/TMP /corefile/. The file name is in the format of core-command name-pid-timestamp.
  • The core_pattern naming parameters are as follows:
%e Dump command name %p Dump process PID %t Dump time stamp (seconds since January 1, 1970) %s Signal that caused the core dump %c Dump file size upper limit %g Actual group ID of the dump process %u Actual user ID of the dump process % h host nameCopy the code

Prerequisites for generating core files

  • Setting environment variables: Enable core file generation limits by setting environment variables such as ulimit -c described earlier.
  • To generate core files, the compiler must support dumping a mirror of the current process into a file in some format, such as GCC /g++ -g option.
  • Special crash signals: The Linux kernel determines whether to generate core files based on the type of process exit signals. For example, signals such as SIGSEGV and SIGABRT produce core, while signals such as SIGALRM and SIGPIPE do not.

GDB debugs core files

After the program core is dumped, run the GDB program core command to view the core file, where program is the name of the executable program and core is the generated core file name. The bt (backtrace) command is then executed to view the function call stack to locate the crash. Other GDB debugging tips are not covered here.

Disadvantages of core files

  • Because core files mirror the address space of the current process, core files tend to be large, which takes up disk space and takes time to download files from the server to local analysis.
  • For a coredump caused by a buffer overflow, the process’s call stack has been overwritten and broken, and the core file often displays the wrong stack information.
  • If the program crashes due to SIGALRM, SIGPIPE and other signals, core files will not be generated.