Where are core dumps written on Mac?

Question

On Mac OS X, if I send SIGQUIT to my C program, it terminates, but there is no core dump file.

Do you have to manually enable core dumps on Mac OS X (how?), or are they written to somewhere else instead of the working directory?

Instead of complaining you could rephrase it - in fact your title does not even have a verb in it. I would gladly upvote your question because I'm interested about the subject. Still I think that the question is not following the quality required by SO. I even have related question regarding coredump http://stackoverflow.com/questions/2207233/how-to-enable-full-coredumps-on-os-x By the way, coredumps are to be located in `/cores` but do look in this folder using the terminal and root account. — sorin, Feb 05 '10 at 14:12
@Sorin FYI 'are' is a (linking) verb. Not that it really matters here, but if we are criticizing grammar let's get it right ;) http://examples.yourdictionary.com/reference/examples/examples-of-linking-verbs.html — Rick Smith, Apr 11 '14 at 20:01
Related: [How to generate core dumps in Mac OS X?](http://stackoverflow.com/questions/9412156/how-to-generate-core-dumps-in-mac-os-x). — kenorb, Oct 11 '14 at 14:33

score 98 · Accepted Answer · edited Sep 03 '19 at 22:57

98

It seems they are suppressed by default. Running

$ ulimit -c unlimited

Will enable core dumps for the current terminal, and it will be placed in /cores as core.PID. When you open a new session, it will be set to the default value again.

edited Sep 03 '19 at 22:57

Timo Tijhof

10,032
6
34
48

answered Jan 17 '10 at 12:27

xyz

27,223
29
105
125

kenorb · Answer 2 · 2018-01-25T20:00:24.247

On macOS, your crash dumps are automatically handled by Crash Reporter.

You can find backtrace files by executing Console and going to User Diagnostic Reports section (under 'Diagnostic and Usage Information' group) or you can locate them in ~/Library/Logs/DiagnosticReports.

You can also check where dumps are generated by monitoring system.log file, e.g.

tail -f /var/log/system.log | grep crash

The actual core dump files you can find in /cores.

See also:

score 15 · Answer 3 · answered Aug 17 '13 at 12:57

15

Additionally, the /cores directory must exist and the user running the program must have write permissions on it.

answered Aug 17 '13 at 12:57

user666406

181
1
4

6

I just cleaned it up, taking 186GB of my space! – Dragonborn Sep 04 '15 at 10:33

score 13 · Answer 4 · answered Feb 13 '12 at 22:16

13

The answer above,

ulimit -c unlimited

works -- but be sure to run that in the same terminal from which you will run the program that dumps core. You need to run the ulimit command first.

answered Feb 13 '12 at 22:16

Joshua Richardson

1,827
22
22

score 12 · Answer 5 · answered Jan 17 '10 at 12:27

12

by default, specific directories in mac osx are hidden. you might want to enable this feature in the terminal and then the core dump should be visible within the directory /cores.

defaults write com.apple.finder AppleShowAllFiles TRUE

answered Jan 17 '10 at 12:27

Gnark

4,080
7
33
44

4

Thank you. I was browsing with Terminal (ls -lah), but that's a useful tip anyway. – xyz Jan 17 '10 at 12:44

neoneye · Answer 6 · 2022-12-21T22:55:53.250

There is a great explanation by Quinn “The Eskimo!” on Apple's forums https://developer.apple.com/forums/thread/694233

I roughly followed that guide. Here are the steps that I did.

Grant write all access to the /cores dir

PROMPT> ls -la / | grep cores
drwxr-xr-x    2 root  wheel    64 Dec  8  2021 cores
PROMPT> sudo chmod 1777 /cores
PROMPT> ls -la / | grep cores
drwxrwxrwt    2 root  wheel    64 Dec 21 23:29 cores

Set size of core file

PROMPT> ulimit -c unlimited

Compile and sign the program

PROMPT> cargo build --release -p my-crashing-program
PROMPT> /usr/libexec/PlistBuddy -c "Add :com.apple.security.get-task-allow bool true" tmp.entitlements
PROMPT> codesign -s - -f --entitlements tmp.entitlements my-crashing-program

Run the program

PROMPT> my-crashing-program
thread 'main' panicked at 'boom', my-crashing-program/src/main.rs:74:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
dumping core for pid 80995
zsh: quit       my-crashing-program

Now there is a core file

PROMPT> ls /cores
core.80995

Also Apple's Console app has a list with Crash Reports.

Where are core dumps written on Mac?

6 Answers6

Linked