42

I want to change the default location of core dump files so that every time a core dump is generated ,it goes to that directory.Also, is it possible to save the dump file by the name of the crashed file in this location?

rogue_knight9
  • 531
  • 1
  • 6
  • 11

2 Answers2

72

Yes, it is. You can change /proc/sys/kernel/core_pattern to define the pathname used to generate the corefile. For more, see man core

example:

echo '/tmp/core_%e.%p' | sudo tee /proc/sys/kernel/core_pattern    # `tee' instead of > so that
                                                                   # opening happens in the
                                                                   # elevated process

would cause all future core dumps to be generated in /tmp and be named core_[program].[pid]

ivan_pozdeev
  • 31,209
  • 16
  • 94
  • 140
mata
  • 63,859
  • 10
  • 155
  • 155
  • 21
    +1 for the `tee` trick ;) Note that there is also `sysctl`. Then it is `sysctl -w kernel.core_pattern='/tmp/core_%e.%p'` – hek2mgl Dec 02 '13 at 14:38
  • A straightforward alternative to `tee` is `sudo bash -c "echo '/tmp/core_%e.%p' >/proc/sys/kernel/core_pattern"`. – ivan_pozdeev Jun 08 '19 at 11:14
  • On arch I have no man entry for core :/ `No manual entry for core in section 5` – xeruf Dec 30 '20 at 10:50
  • @Xerus it should be there... `$ pacman -Q --owns /usr/share/man/man5/core.5.gz` - `/usr/share/man/man5/core.5.gz is owned by man-pages 5.09-2` maybe you need to install that package? – mata Dec 30 '20 at 15:51
  • ah, I only had `man` installed, not `man-pages`, thanks :) – xeruf Dec 31 '20 at 12:52
31

Before following the instructions in the accepted answer, it could be good idea to check the contents of /proc/sys/kernel/core_pattern to see if the Redhat abrt system is in use.

-> cat /proc/sys/kernel/core_pattern
|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e

If that is in use, then you already have a pretty extensive scheme for managing core files that you would want to understand before you override it.

In a nutshell, abrt:

  1. puts the core files here: /var/spool/abrt/
  2. has a gui that is started with the command abrt-gui
  3. augments the corefile with additional information about the failed process.
  4. is configure with this file: /etc/abrt/abrt-action-save-package-data.conf

One common stumbling block with using it is to change this line in the config file:

ProcessUnpackaged = no

Change that to yes to capture core files from your homebrew processes, otherwise it will only capture corefiles from programs installed by the package manager.

[EDIT to answer how to use coredump] To examine a core dump I do this:

cd /var/spool/abrt/XXXXXXX
gdb $(cat executable) coredump

There might be a better way to so that, but gdb has served me well so I have not looked for other ways. Just replace XXXXXXX with the folder that contains your coredump file. The gdb command is cut and paste ready.

References:

Redhat Book

CentOS Forum

Be Kind To New Users
  • 8,861
  • 13
  • 71
  • 117
  • thanks for this info. I got the coredump file, but how to open it with abrt ? – Devos Oct 01 '14 at 02:00
  • if you are not sure about how the core file was generated, just do #file core.XYZ - this will show the command executed for generating the corefile. – kumar Mar 31 '15 at 12:20
  • 1
    In Ubuntu since 16.04, [`apport` is used the same way and saves dumps into `/var/crash/`](https://askubuntu.com/questions/966407/where-do-i-find-the-core-dump-in-ubuntu-16-04lts). – ivan_pozdeev Jun 08 '19 at 11:40