Wednesday, June 11, 2008

Configuring the core file name pattern in Linux

First of all, you must make sure that you have set proper ulimit in your shell. You can check this by giving "ulimit -a" command. If the core file size is set to be 0, you can make it unlimited by giving "ulimit -c unlimited". Refer to your shell's man page to know how to set this. The child always inherits the ulimit from its parent process.

You can configure your system such that when an application dumps core the name of the core file has some meaningful name instead of just the bare word core. There are two files you should modify under /proc/sys/kernel configure this.

/proc/sys/kernel/core_pattern
- This contains pattern of the core file name. The following patterns are allowed:
%% output one '%'
%p pid
%u uid
%g gid
%s signal number
%t UNIX time of dump
%h hostname
%e executable filename

/proc/sys/kernel/core_uses_pid - If this file contains a non-zero value, then the core file name will always be suffixed with the PID of the process.

You must be root to configure these things. Here is an example to make the core file name to contain executable file name and time of the dump:
echo core.%e.%t > /proc/sys/kernel/core_pattern

When a process dumps core, you will see the corefile name like this: core.a.out.1213240387.23989. (I had my core_uses_pid to be 1, so the PID is suffixed.)

A useful one liner to find out the time of the core in a better form is: perl -e 'print scalar(localtime(XXX))' where XXX is the time you are seeing in the core dump file name. Like this:
# perl -e 'print scalar(localtime(1213240387))'
Wed Jun 11 20:13:07 2008

I took the format info from the Linux kernel documentation (Documentation/sysctl/kernel.txt).

1 comment:

Harris The Virus said...

surprise surprise, I am trying to do the same thing on Solaris today, little bit of googling and came up on your blog.

cheers,
Harry