Receive our weekly advanced programming tips for FREE
How to manage core files in linux and why they are important
| 0 votes
Autor: bookkeeper
Chapter: Linux


What is a core file? Everytime when a program crashes, the kernel will write everything what the program allocated to this "core" file. It's very usefull for a developer, he put the core file into a debugger and see exactly why and where the program crached even with the variables values.

We need:

The program should be compiled in debug mode in gcc it's the flag '-g'.

Here a little crash program:

#include <stdio.h>

typedef struct Crash{
 int a;

int main(){
 printf("-- Crash Test --\n");

 Crash* boom = NULL;
 //crash it baby!
 // NULL Pointer is not nice ;)
 printf( "%d\n", boom->a );

 return 0;


gcc -Wall -g3 -o crash crash.c

Set the maximum size of the core file

ulimit -c unlimited

Start it!


When the program crash:

-- Crash Test --
Segmentation fault (core dumped)

After this you will find a 'core' file

Lets see what the debugger say:

gdb ./crash core

The output will be:

GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /lib/tls/i686/cmov/
Loaded symbols for /lib/tls/i686/cmov/
Reading symbols from /lib/
Loaded symbols for /lib/
Core was generated by `./crash'.
Program terminated with signal 11, Segmentation fault.
[New process 19837]
#0  0x080483cb in main () at crash.c:15
15     printf( "%d\n", boom->a );
(gdb) where
#0  0x080483cb in main () at crash.c:15
(gdb) frame 0
#0  0x080483cb in main () at crash.c:15
15     printf( "%d\n", boom->a );

Aha! It crashed in file crash.c at line 15

When is a big program for sure you want to known where exactly it crashed and which functions were called, for this type 'where', it will show you where it started and where it ends. If you want to jump into a frame, just type 'frame 0', he will show the sourcecode line.

How to write core files

Hmm, OK, that great, but how can i tell the system to write core files?

that simple, just type:

set the core file size to unlimited

ulimit -c unlimited

Use process id at core file

echo "1" > /proc/sys/kernel/core_uses_pid

Path to core files:

echo "/path/to/core/files/core.%p.%e" > /proc/sys/kernel/core_pattern

Parameter are:

  %%  A single % character
  %p  PID of dumped process
  %u  real UID of dumped process
  %g  real GID of dumped process
  %s  number of signal causing dump
  %t  time of dump (secs since 0:00h, 1 Jan 1970)
  %h  hostname (same as the 'nodename'  returned by uname(2))
  %e  executable filename

thats all :)