3

Answers to related questions all suggest using lsof or checking under /proc/NPID/, which is not helpful for when the process is already gone and only its core-dump remains.

However, it should be possible to obtain the file-descriptors opened by the late process, along with the filesystem-identifier(s) and inode-number for each.

I realize, this is OS-specific, but I only need it for (modern) Linux... I suppose, it needs to be a script fed to gdb, but what are the global symbols to look for?

Mikhail T.
  • 834
  • What led to to your declaration that this is possible, upon which premise you are basing the question? – JdeBP Jun 22 '18 at 18:06
  • 1
    @JdeBP, I'm fairly certain, opened file-descriptors are listed in the process' memory somewhere, and gdb should be able to print them. Even if the descriptors themselves aren't available, the stdio data-structures (the FILE structures) certainly are -- if stdio is used, that is... – Mikhail T. Jun 22 '18 at 20:48
  • So you did not get this idea from any doco, then? I hope not. Such doco would need correction. (-: – JdeBP Jun 24 '18 at 23:30
  • I don't think this is possible. The core dump just contains file descriptor numbers, the translation to FSID and inode comes from the kernel's file table. And what about things like pipes and sockets -- the endpoints of these no longer exist. – Barmar Jun 28 '18 at 16:59
  • I only care for the "real" files, actually -- are you sure, FSIDs and inums aren't in the core somewhere? – Mikhail T. Jun 28 '18 at 19:37
  • Btw. there's a similar question at https://stackoverflow.com/questions/58564/core-dump-files-on-linux-how-to-get-info-on-opened-files – oliver Nov 15 '19 at 16:44

0 Answers0