Controlling core files (Linux)

Core files get created when a program misbehaves due to a bug, or a violation of the cpu or memory protection mechanisms. The operating system kills the program and creates the core file.

If you don't want core files at all, set "ulimit -c 0" in your startup files. That's the default on many systems; in /etc/profile you may find

 
ulimit -S -c 0 > /dev/null 2>&1 
 

If you DO want core files, you need to reset that in your own .bash_profile:

 
ulimit -c 50000 
 

would allow core files but limit them to 50,000 bytes.

You have more control of core files in /proc/sys/kernel/

For example, you can do eliminate the tagged on pid by

 
echo "0" > /proc/sys/kernel/core_uses_pid 
 

Core files will then just be named "core". People do things like that so that a user can choose to put a non-writable file named "core" in directories where they don't want to generate core dumps. That could be a directory (mkdir core) or a file (touch core;chmod 000 core). I've seen it suggested that a symlink named core would redirect the dump to wherever it pointed, but I found that didn't work.

But perhaps more interesting is that you can do:

mkdir /tmp/corefiles 
chmod 777 /tmp/corefiles 
echo "/tmp/corefiles/core" > /proc/sys/kernel/core_pattern 
 

All corefiles then get tossed to /tmp/corefiles (don't change core_uses_pid if you do this).

Test this with a simple script:

 
# script that dumps core 
kill -s SIGSEGV $$ 

 

(Article continues after the break)

But wait, there's more (if your kernel is new enough). From "man proc":

/proc/sys/kernel/core_pattern 
    This file (new in Linux 2.5) provides finer control over the
    form of a core filename than the obsolete
    /proc/sys/kernel/core_uses_pid file described below. The name
    for a core file is controlled by defining a template in
    /proc/sys/kernel/core_pattern. The template can contain %
    specifiers which are substituted by the following values when
    a core file is created: 
 
     
  %%  A single % character 
  %p  PID of dumped process 
  %u  real UID of dumped process 
  %g  real GID of dumped process 
  %s  number of signal causing dump 
  %t  time of dump (secs since 0:00h, 1 Jan 1970) 
  %h  hostname (same as the 'nodename'  
      returned by uname(2)) 
  %e  executable filename 
     
 
    A single % at the end of the template is dropped from the core
    filename, as is the combination of a % followed by any character
    other than those listed above. All other characters in the
    template become a literal part of the core filename. The maximum
    size of the resulting core filename is 64 bytes. The default
    value in this file is "core". For backward compatibility, if
    /proc/sys/kernel/core_pattern does not include "%p" and
    /proc/sys/kernel/core_uses_pid is non-zero, then .PID will be
    appended to the core filename. 
 

If you are running a Linux kernel that doesn't support this, you'll get no core files at all, which is also what happens if the directory in core_pattern doesn't exist or isn't writable by the user dumping core. So that's yet another way to not dump core for certain users: set core_pattern to a directory that they can't write to, and give write permission to the users who you do want to create core files.

The "ulimit" can do much more: see Understanding ulimit

22 comments

More Articles by Tony Lawrence - Find me on Google+ 2005-03-01

Click here to add your comments




Sat Feb 9 06:57:20 2008: 3628   anonymous


This topic was really helpful to know about core files in linux/unix. Appreciated!!



Mon Jun 23 16:11:03 2008: 4363   anonymous
http://www.724care.com

Ultimate guide. It does take some time to figure out why there are no core files on ubuntu. apport is not set correctly by default to handle core files in server installations. This write up is really getting to the bottom of it.







Mon Dec 8 22:18:25 2008: 4884   anonymous


I found this page via Google, and just wanted to say that I found it really useful - no need for further research. First click, and satisfied - awesome! thanks!



Mon Feb 9 05:46:55 2009: 5350   ZhichangYu


Really good guide! However It's a pity that it doesn't mention that /etc/sysctl.conf controls all settings under /proc/sys.



Mon Feb 9 12:12:45 2009: 5351   TonyLawrence


A pity?

:-)

I guess sysctl and sysctl.conf are fairly standard now but weren't when this was written. Not all distros used sysctl.conf then and I wouldn't bet my life that all do today.

I think it is probably true that sysctl.conf is a fairly safe assumption now, but more generally you should never assume that because you know something about one distro at one point in time that it applies to other distros or even that same distro at another point in time.

If you pawed through the thousands of posts here, you'd find lots of examples like that: things that were once true that aren't now, things that mention /proc but not sysctl, things that mention sysctl but not sysctl.conf, things that have changed, things that now don't work the way they did when the post was written - it's impossible for me to keep up with and that's why I REALLY APPRECIATE COMMENTS LIKE THIS.

Even when laced with pity :-)















Fri Apr 17 19:13:29 2009: 6216   Slinky
http://slinkydiss.blogspot.com

Use this to find core files and remove them:

find . | egrep "\/core\.[0-9]+$" | xargs rm -f

This works well as it finds only core files.

Courtesy of http://www.shell-fu.org/lister.php?id=680



Fri Apr 17 19:42:12 2009: 6217   TonyLawrence


Well, sure..

But that's not what this article was about. :-)



Thu Jun 4 07:10:10 2009: 6437   DomenPuncer


From manual: "Values are in 1024-byte increments..."

so ulimit -c 50000 is about 50 MB



Thu Jun 4 10:08:55 2009: 6438   TonyLawrence


Ooops - thanks!



Fri Jun 19 04:44:19 2009: 6516   anonymous


This article looks informative.
Could you please tell me, how can we store core dumps in NVRAM ?






Fri Jun 19 09:26:49 2009: 6517   TonyLawrence


I can't imagine why you want to do that, but obviously you'd need th NVRAM mounted and you'd use the "/proc/sys/kernel/core_pattern" explained above.

Given the usual size of NVRAM and the overhead of filesystems, you couldn't store much..



Tue Dec 8 17:29:20 2009: 7725   anonymous


I am using Kill -9 to teminate a pid and not getting a core file. Are core files not generated for kill -9 signals? (it does for other Kill signals)



Tue Dec 8 18:33:24 2009: 7726   TonyLawrence


"man signal" will tell you which signals dump core.



Mon Mar 8 08:41:01 2010: 8192   RickvanderZwet
http://rickvanderzwet.nl



Very nice and informative explanation. Works great under RHEL4 for example



Wed Dec 15 14:58:09 2010: 9168   vmguy




To complete the article, the following points should be made:

- To print the call stacks from a core file using gdb:
thread apply all bt

- If any of the function names in the core file are annotated as "??",
it is an indication that the core file may have been truncated on
the filesystem. Another ulimit value controls this:

ulimit -f unlimited

- The core file may also be truncated because there is insufficient space
on the filesystem to write it ... especially if this is a 64-bit app.

cat /proc/sys/kernel/core_pattern

Example: if this contains /work, then check the filesystem for space
df -k /work
Freespace is displayed as a percentage of total space and as the
number of free 1K blocks. Do the math. If the calculation shows
1.5GB is available, then a 2GB core file won't fit there.

Nice article, Tony.






Wed Dec 15 15:06:40 2010: 9169   TonyLawrence




Thanks for the additional notes!



Mon Jan 31 22:11:04 2011: 9265   anonymous




Your article was very informative. However, there seems to be an issue with the core_uses_pid variable. In the distro I am using (RHEL5), this has no effect. In searching the net, I found reference to this some time ago, along with mention of a patch to fix it, but this does not seem to have taken place. I have core_uses_pid set to 0, and no %p in core_pattern, but I still get the PID appended to the core file name.



Mon Jan 31 22:31:55 2011: 9266   TonyLawrence




I'm not surprised. Nobody every accused Linux kernel developers of being consistent.



Sat Feb 5 01:58:20 2011: 9278   Venkat




Awesome aticle. Our Test server was crashing everyday but there was no core file being generated. This article helped him overwrite those settings. THANKS.



Sun Nov 6 14:25:28 2011: 10127   Neha




HI

Actually a lot of core files are being generated on my database server on path /var/opt/OV/tmp after every 15 min.How to let it not be generated



Sun Nov 6 14:33:58 2011: 10128   TonyLawrence




Umm, that's what this whole page is about?

Don't miss responses! Subscribe to Comments by RSS or by Email

Click here to add your comments

If you want a picture to show with your comment, go get a Gravatar

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

I am a Kerio reseller. Articles here related to Kerio products reflect my honest opinion, but I do have an obvious interest in selling those products also.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.