12

Can I configure what goes into a core dump on Linux? I want to obtain something like the Windows mini-dumps (minimal information about the stack frame when the app crashed). I know you can set a max size for the core files using ulimit, but this does not allow me to control what goes inside the core (i.e. there is no guarantee that if I set the limit to 64kb it will dump the last 16 pages of the stack, for example).

Also, I would like to set it in a programmatic way (from code), if possible. I have looked at the /proc/PID/coredump_filter file mentioned by man core, but it seems too coarse grained for my purposes.

To provide a little context: I need tiny core files, for multiple reasons: I need to collect them over the network, for numerous (thousands) of clients; furthermore, these are embedded devices with little SD cards, and GPRS modems for the network connection. So anything above ~200k is out of question.

EDIT: I am working on an embedded device which runs linux 2.6.24. The processor is PowerPC. Unfortunately, powerpc-linux is not supported in breakpad at the moment, so google breakpad is not an option

Lorenzo Dematté
  • 7,638
  • 3
  • 37
  • 77
  • 1
    I have no idea, and the answer lies probably inside the kernel source code (because there is no specification related to that). Why do you ask? With current disks, a 64Mb core dump limit is still small, and would very probably contain enough information. Why do you need to set the limit to such a tiny value like 64kb. ? – Basile Starynkevitch Jan 12 '12 at 14:18
  • 4
    Google Breakpad writes minidumps on all platforms, including Linux. – Cat Plus Plus Jan 12 '12 at 14:38
  • I ask because I am using an embedded device, which has a small flash disk and especially a slow gprs connection to download data.. I want it to be as small as possible! – Lorenzo Dematté Jan 12 '12 at 15:02
  • I will look at Breakpad.. never heard of it before! I hope that it works for my architecture (which I should have mentioned, I will edit the question) – Lorenzo Dematté Jan 12 '12 at 15:04
  • Unfortunately google breakpad does not support powerpc-linux! – Lorenzo Dematté Apr 11 '13 at 10:31

1 Answers1

10

I have "solved" this issue in two ways:

  1. I installed a signal handler for SIGSEGV, and used backtrace/backtrace_symbols to print out the stack trace. I compiled my code with -rdynamic, so even after stripping the debug info I still get a backtrace with meaningful names (while keeping the executable compact enough).
    I stripped the debug info and put it in a separate file, which I will store somewhere safe, using strip; from there, I will use add22line with the info saved from the backtrace (addresses) to understand where the problem happened. This way I have to store only a few bytes.
  2. Alternatively, I found I could use the /proc/self/coredump_filter to dump no memory (setting its content to "0"): only thread and proc info, registers, stacktrace etc. are saved in the core. See more in this answer

I still lose information that could be precious (global and local variable(s) content, params..). I could easily figure out which page(s) to dump, but unfortunately there is no way to specify a "dump-these-pages" for normal core dumps (unless you are willing to go and patch the maydump() function in the kernel).

For now, I'm quite happy with there 2 solutions (it is better than nothing..) My next moves will be:

  • see how difficult would be to port Breakpad to powerpc-linux: there are already powerpc-darwin and i386-linux so.. how hard can it be? :)
  • try to use google-coredumper to dump only a few pages around the current ESP (that should give me locals and parameters) and around "&some_global" (that should give me globals).
Community
  • 1
  • 1
Lorenzo Dematté
  • 7,638
  • 3
  • 37
  • 77
  • While it would be simple to fork google-coredumper and modify the `WriteCoreDump` function to dump specific pages/addresses.. it has no support for powerpc :( – Lorenzo Dematté Apr 12 '13 at 13:39