2

I found this old core file in my root directory from June:

$ ll /core
-rw------- 1 root root 46215168 Jun 20 16:16 /core

$ sudo file /core 
/core: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/lib/xorg/Xorg -core :1 -seat seat0 -auth /var/run/lightdm/root/:1 -noliste'

How can I find out what application's crash produced this core dump? Is it from Xorg or from lightdm as suggested by the file output or may it be something else? What other meaningful information can I get from analyzing it and how would I do that?

Update: 

$ sudo gdb -c /core
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.04) 7.11.1
[some lines regarding copyright, license and manuals omitted...]
Type "apropos word" to search for commands related to "word".
[New LWP 6453]
Core was generated by `/usr/lib/xorg/Xorg -core :1 -seat seat0 -auth /var/run/lightdm/root/:1 -noliste'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007f14feb55418 in ?? ()
(gdb)
Zanna
  • 70,465
Byte Commander
  • 107,489
  • You may be able to get more info using gdb -c core - see A big core dump appeared in my home folder – steeldriver Nov 20 '16 at 19:31
  • @steeldriver Updated with the output of gdb. So what exactly does that tell me? – Byte Commander Nov 20 '16 at 20:04
  • Both file and gdb tell you that the program that died with a SIGABRT(see man 7 signal) was /usr/lib/xorg/Xorg, which was called with these parameters: -core :1 -seat seat0 -auth /var/run/lightdm/root/:1 -nolisten. Start with man 5 core. gdb is of most use when one has the object (*.o) and source (*.c) files available. – waltinator Nov 20 '16 at 20:26
  • 1
    @ByteCommander Did you figured out what is the cause of creating this core files ? I have got it after every shutdown – EdiD Jan 01 '17 at 16:59
  • @EdiD You see the command that was responsible for the core dump when you analyse it with file /core and check the string inside single quotes in the end, ..., from '<COMMAND>'. Probably it's something different for you than it was for me. – Byte Commander Jan 01 '17 at 20:35
  • @ByteCommander output of file /core is identical. I observed that core files are dumped while powering off with poweroff command and are not dumped when using gui shutdown (nothing in journal about this) – EdiD Jan 03 '17 at 16:56

0 Answers0