45

I want to change the default location of core dump files so that every time a core dump is generated ,it goes to that directory.Also, is it possible to save the dump file by the name of the crashed file in this location?

rogue_knight9
  • 561
  • 1
  • 6
  • 11

3 Answers3

78

Yes, it is. You can change /proc/sys/kernel/core_pattern to define the pathname used to generate the corefile. For more, see man core

example:

echo '/tmp/core_%e.%p' | sudo tee /proc/sys/kernel/core_pattern    # `tee' instead of > so that
                                                                   # opening happens in the
                                                                   # elevated process

would cause all future core dumps to be generated in /tmp and be named core_[program].[pid]

ivan_pozdeev
  • 33,874
  • 19
  • 107
  • 152
mata
  • 67,110
  • 10
  • 163
  • 162
  • 21
    +1 for the `tee` trick ;) Note that there is also `sysctl`. Then it is `sysctl -w kernel.core_pattern='/tmp/core_%e.%p'` – hek2mgl Dec 02 '13 at 14:38
  • A straightforward alternative to `tee` is `sudo bash -c "echo '/tmp/core_%e.%p' >/proc/sys/kernel/core_pattern"`. – ivan_pozdeev Jun 08 '19 at 11:14
  • On arch I have no man entry for core :/ `No manual entry for core in section 5` – xeruf Dec 30 '20 at 10:50
  • @Xerus it should be there... `$ pacman -Q --owns /usr/share/man/man5/core.5.gz` - `/usr/share/man/man5/core.5.gz is owned by man-pages 5.09-2` maybe you need to install that package? – mata Dec 30 '20 at 15:51
  • ah, I only had `man` installed, not `man-pages`, thanks :) – xeruf Dec 31 '20 at 12:52
  • If you need to append this line in .bashrc, use `echo '/tmp/core_%e.%p' | sudo tee /proc/sys/kernel/core_pattern >/dev/null` instead. Otherwise scp would be broken. – xnervwang Nov 10 '22 at 01:08
  • @xnervwang definitely not! Don't put `sudo` in a `.bashrc`! There will always be a better way to do what you're trying to. In this case, add an entry in a `/etc/sysctl.d/*.conf` file or `/etc/systcl.conf` to make it permanent. – mata Nov 14 '22 at 20:28
  • @mata I cannot... The dev machine is under control of my company. Any modification to the system files would be reverted periodically. – xnervwang Nov 15 '22 at 00:42
  • Note that on Ubuntu, the contents of `/proc/sys/kernel/core_pattern` are periodically overwritten by an automated process, clobbering any manual changes you may have made. Instructions on how to prevent this can be found [here](https://askubuntu.com/a/420628). – dshin Dec 21 '22 at 16:01
31

Before following the instructions in the accepted answer, it could be good idea to check the contents of /proc/sys/kernel/core_pattern to see if the Redhat abrt system is in use.

-> cat /proc/sys/kernel/core_pattern
|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e

If that is in use, then you already have a pretty extensive scheme for managing core files that you would want to understand before you override it.

In a nutshell, abrt:

  1. puts the core files here: /var/spool/abrt/
  2. has a gui that is started with the command abrt-gui
  3. augments the corefile with additional information about the failed process.
  4. is configure with this file: /etc/abrt/abrt-action-save-package-data.conf

One common stumbling block with using it is to change this line in the config file:

ProcessUnpackaged = no

Change that to yes to capture core files from your homebrew processes, otherwise it will only capture corefiles from programs installed by the package manager.

[EDIT to answer how to use coredump] To examine a core dump I do this:

cd /var/spool/abrt/XXXXXXX
gdb $(cat executable) coredump

There might be a better way to so that, but gdb has served me well so I have not looked for other ways. Just replace XXXXXXX with the folder that contains your coredump file. The gdb command is cut and paste ready.

References:

Redhat Book

CentOS Forum

Be Kind To New Users
  • 9,672
  • 13
  • 78
  • 125
  • thanks for this info. I got the coredump file, but how to open it with abrt ? – Devos Oct 01 '14 at 02:00
  • if you are not sure about how the core file was generated, just do #file core.XYZ - this will show the command executed for generating the corefile. – kumar Mar 31 '15 at 12:20
  • 1
    In Ubuntu since 16.04, [`apport` is used the same way and saves dumps into `/var/crash/`](https://askubuntu.com/questions/966407/where-do-i-find-the-core-dump-in-ubuntu-16-04lts). – ivan_pozdeev Jun 08 '19 at 11:40
0

By default, a core dump file is named core or core.pid (if the file /proc/sys/kernel/core_uses_pid contains the value 1) is created in the current working directory.

But the /proc/sys/kernel/core_pattern file can be used to set to define a template that is used to name and set path for core dump files. The default value in this file is "core".

We can set the core dump file name as $ sudo sysctl -w kernel.core_pattern="/tmp/%e_core.%p" When our application crashes(say sleep), we would expect a file with the pattern of sleep_core.pid to appear under /tmp folder. Where %e is the program name and %p is the program’s PID.

Disha Gugnani
  • 34
  • 2