Linux – core dump — linux

core-dumplinuxlinux-kernel

I'm trying to understand the core dump generation. Is the core dump generated separately for a user space application process crash and the kernel level crash? Is the ulimit -c for both kinds?

Best Answer

When a userland program crashes, it can leave a core file behind, containig a copy of the contents of the memory when it went down (the core name comes from the prehistory of computing, when memory was core). This is controlled by the ulimit(1) command, it is normally disabled as the core files are large and tend to confuse newbies. A core file can be analyzed by e.g. a debugger, together with the executable and symbol table, to find out what happened.

When the kernel crashes, it normally triggers a kernel panic. If the kernel has found some critical inconsistency, it really isn't wise to count on it bahaving sanely to write out anything. So no core gets generated, and the system goes down. Contents of registers and code surrounding the address where the problem happened is written to the console. It is a good idea to save this (e.g. take a picture) for possible later analysis.

A similar situation is the kernel Oops, when the kernel detects an inconsistency that isn't considered fatal. In that case (as in a kernel panic) contents of registers and code surrounding the address where the problem happened is written to the console, and also logged.

Related Solutions

Ubuntu – No core dump on Ubuntu on a Parallels shared folder

I couldn't clearly find the underlying reason why, but the zero length core file was caused by trying to create the core file on a Parallels Shared Folder.

I solved the problem by running the application from a local directory. I suppose another alternative would be to set /proc/sys/kernel/core_pattern to dump core files into a local directory.

Centos – How to disable core dump generation in Centos (cPanel Server)

You need to execute ulimit -c 0 in the script that starts the webserver, probably /etc/init.d/apache or /etc/init.d/httpd. Place it near the top, but don't make it the first line.

Alternatively you can change the way the core dump is written, so that subsequent core dumps overwrite the previous instead of creating a new file. Add these lines to /etc/sysctl.conf:

kernel.core_uses_pid = 0
kernel.core_pattern = core

and run sysctl -p. Now the core dumps will be named simply core.

You could now also create a zero-sized file owned by root with no write permissions; as the core dump is written with the privileges of the process owner, it won't be able to overwrite that file, hence no core dump.

Best Answer

Related Solutions

Ubuntu – No core dump on Ubuntu on a Parallels shared folder

Centos – How to disable core dump generation in Centos (cPanel Server)

Related Question