> cool solutions home

When working with support or an application writer to troubleshoot a program, a core file may be requested. A core file is a file created by the operating system when a program terminates unexpectedly, encounters a bug, or violates the operating system's protection mechanisms (See "core" at http://www.tldp.org/LDP/Linux-Filesystem-Hierarchy/html/glossary.html)

By default core files are not created on SUSE Linux systems. Whether or not the operating system creates core files is controlled by the ulimit command. To see the current ulimit setting for core files, do the following:

#ulimit -c
0

The ulimit command sets limits on the resource available to the bash shell. The -c parameter controls the size of core files. The value 0 indicates that core files are not created. To enable core file creation, increase the size limit of core files to a number greater than zero. For example:

#ulimit -c 50000

allows core files and limits the file size to 50000 bytes.

The default value of 0 is set in /etc/profile with the line:

ulimit -Sc 0     #don't create core files

Although the default value for creating core files can be changed in /etc/profile, it's not wise to enable core file creation in most situations. To enable core file creation for a certain user, add the ulimit -c command the the users .profile file.

If you need to enable core file creation temporarily to create a core file for a problem application, increase the ulimit at the command line and then run the application.

Two other parameters allow control of core file creation as follows:

1. /proc/sys/kernel/core_uses_pid - Appends the coring processes PID to the core file name. The name of the core file is set in /proc/sys/kernel/core_pattern. Default is 0, or don't append the PID. To enable the PID append, use:
   
   echo 1 > /proc/sys/kernel/core_uses_pid
   
   
2. /proc/sys/kernel/core_pattern - Determines the name and location where core files are created. The default on SUSE systems in core, which means that a core file for an application will be created in the processes current working directory and named core. The core_pattern value can include a path. For example, setting core_pattern to /tmp/corefiles/core will cause all core files to be created in /tmp/corefiles and named core. In this situation, using the PID in naming is necessary to avoid overwriting.
   
   The core_pattern can be configured to uniquely name the core file, as described in this excerpt from the proc man page (man 5 proc):
   
   "/proc/sys/kernel/core_pattern
                 This file (new in Linux 2.5) provides finer control over the form of a core filename than the  obsolete
                 /proc/sys/kernel/core_uses_pid    file    described below.  The name for a core file is  controlled  by
                 defining  a  template in /proc/sys/kernel/core_pattern.  The template can contain % specifiers  which
                 are substituted by the following values when a core file is created:
                                                                                  
                   %%  A single % character
                   %p  PID of dumped process
                   %u  real UID of dumped process
                   %g  real GID of dumped process
                   %s  number of signal causing dump
                   %t  time of dump (secs since 0:00h, 1 Jan 1970)
                   %h  hostname (same as the 'nodename'
                       returned by uname(2))
                   %e  executable filename
                                                                                  
                 A single % at the end of the  template  is  dropped from  the core filename, as is the combination of a
                 % followed by any character other than those listed above.  All other characters in the template become
                 a literal part of the core filename.   The  maximum size  of  the  resulting core filename is 64 bytes.
                 The default value in  this  file  is  "core".   For backward     compatibility,    if    /proc/sys/ker­
                 nel/core_pattern  does   not   include   "%p"   and /proc/sys/kernel/core_uses_pid  is  non-zero,  then
                 .PID will be appended to the core filename."

Examples: Creating A Core File

This section will show three different examples of creating core files. All of the examples will use the application top to create core files. The examples will be as follows:

1. Create a core file in the default pattern with an appended PID
2. Create a core file in a designated directory
3. Create a core file using % specifiers

Create a Core File In The Default Pattern With An Appended PID

Complete the following to take a core of the top program in the default pattern with and appended PID (logged in as root):

# ulimit -c unlimited
# echo 1 > /proc/sys/kernel/core_uses_pid
# cat /proc/sys/kernel/core_pattern
core
# top &
[1] 20992
# kill -6 20992
                                                                               
[1]+  Stopped                 top
# fg %1
top
Aborted (core dumped)
# ls core*
core.20992

Please note that the kill command uses the processes PID and the PID of the process will always be different


Create a Core File In a Designated Directory

Complete the following to take a core of the top program with the core file being saved in a specific directory (logged in as root):

# ulimit -c unlimited
# echo 1 > /proc/sys/kernel/core_uses_pid
# mkdir /corefiles
# chmod 777 /corefiles
# echo /corefiles/core > /proc/sys/kernel/core_pattern
# top &
[1] 20992
# kill -6 20123
                                                                               
[1]+  Stopped                 top
# fg %1
top
Aborted (core dumped)
# ls /corefiles/core*
core.20123

Please note that the kill command uses the processes PID and the PID of the process will always be different


Create a Core File Using % Specifiers

Complete the following to take a core of the top program using % specifiers (logged in as root):

# ulimit -c unlimited
# echo 1 > /proc/sys/kernel/core_uses_pid
# echo /corefiles/core-%e-%p-%t > /proc/sys/kernel/core_pattern
# top &
[1] 24340
# kill -6 24340
                                                                               
[1]+  Stopped                 top
# fg %1
top
Aborted (core dumped)
# ls /corefiles/core*
core-top-24340-1129845522

In this example the core file is created in the /corefiles directory. Notice the core filename includes the executable name, PID, and the time of the core. Notice also that the PID wasn't appended to the core filename. The PID is not appended if the %p specifier is used in the filename.