2

I've been going through intense program/package installation recently, so I can't tell for sure which of the newly installed programs (or old programs) caused the appearance of a core file in my home folder. It's a server, so I better find out any possible sources of instability on the machine.

Desmond Hume
  • 656

2 Answers2

3

Ok, it turned out there was a more straightforward way of identifying a misbehaved program using the file utility:

$ file core
core: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from 'sqlplus'

So sqlplus in the example above would be the main suspect.

Desmond Hume
  • 656
1

One way is to set the name of the core dump file to contain the PID and name of the process that caused the core dump using:

echo "core-%p-%e" | sudo tee /proc/sys/kernel/core_pattern

here is an example of it working:

./example 
Segmentation fault (core dumped)
ls core*
core-4170-example

See man 5 core for more details of how to use the core_pattern interface.

Jeremy Kerr
  • 27,199
Colin Ian King
  • 18,820
  • The filename format doesn't seem to to stick from one boot to another. – Desmond Hume Nov 09 '12 at 13:33
  • Indeed, it is a run time kernel setting. One needs to set it on each reboot. You could add the command to /etc/rc.local for example, and since this is run with root privilege you just need to add the following line in /etc/rc.local: echo "core-%p-%e" > /proc/sys/kernel/core_pattern – Colin Ian King Nov 09 '12 at 13:39