Controlling Core Dump Files in Linux

Core dump again!! That was my reaction after a friend called to ask about an rpm problem. At first I wondered what a core dump was, where the error appeared, and how he knew. Searching reminded me that I had seen it before, on my own blog. Back then I had not investigated the cause because I had limited permission to change things on rented hosting. Looking into it, I found that core dumps mainly result from a program crash or a program attempting to access memory it is not allowed to use, causing the OS to kill the process. In either case, the OS creates a core dump file to help programmers locate errors or debug the program. A core file’s name typically begins with core, followed by a dot and a number (the PID), for example core.20. Let’s look at how to manage core files. To disable creation of core files, run:

[root@ezylinux ~]# ulimit -S -c 0 > /dev/null 2>&1

To enable core file creation, run:

[root@ezylinux ~]# ulimit -S -c 25000 > /dev/null 2>&1  //กำหนดให้ core file มีขนาดเท่ากับ 25,000 byte

[root@ezylinux ~]# ulimit -S -c unlimited > /dev/null 2>&1 //กำหนดให้ core file มีขนาดไม่จำกัด

-c specifies the maximum core file size. To make the setting permanent, add the command above to /etc/profile. We can also choose the path and filename prefix for core files. Use echo to write the desired path and filename to proc/sys/kernel/core_pattern. For example, to write a file named core in /path/corefile:

[root@ezylinux ~]# echo "/path/corefiles/core" > /proc/sys/kernel/core_pattern

The following parameters can be used when changing the core pattern:

• %% - A single % character
• %p - PID of dumped process
• %u - real UID of dumped process
• %g - real GID of dumped process
• %s - number of signal causing dump
• %t - time of dump (secs since 0:00h, 1 Jan 1970)
• %h - hostname (same as the ‘nodename’ returned by uname(2))
• %e - executable filename

By default, the system appends .PID to core filenames. To prevent it from adding .PID when dumping core, run:

[root@ezylinux ~]# echo "0" > /proc/sys/kernel/core_uses_pid

Finally, test the core file settings with:

[root@ezylinux ~]# kill -s SIGSEGV $$