CORE DUMP FOR DEBIAN

CORE DUMP FOR DEBIAN

Mayank Chourey 5/31/2011

Introduction.

Steps to use core dump.

-Enabling and ConfigurinG core dump.

-Enabling core dump

-To limit core file size

-Enabling core dump for specific deamon

-Analyzing core dump

Introduction: It is needed frequently to analyze the cause of a crashed application. One way

to do it is through creating core dump files that can be later analyzed to debug the issue. A core dump file is snapshot of the memory area being used by the application at the time of crash occurred. Creation of core dump files may not be enabled by default, and may require some configuration. This tutorial will be helpful for configuring debian OS.

Steps to use core dump

-Enabling and ConfigurinG core dump:

Enabling core dump:

Append the following lines into “/etc/sysctl.conf” file

1. kernel.core_uses_pid = 1

2. create a directory as /var/log/core_dumps, to create all dumps into this directory. kernel.core_pattern = /var/log/core_dumps/core-%e-%s-%u-%g-%p-%t %%

A single % character

%p PID of dumped process

%u real UID of dumped process

%g real GID of dumped process

%s number of signal causing dump

%t time of dump (secs since 0:00h, 1 Jan 1970)

%h hostname (same as the 'nodename' returned by uname(2))

%e executable filename

Exp: Core file name will look like -----------

3. fs.suid_dumpable = 2 or kernel.suid_dumpable=2

use of fs or kernel is dependent on system.

To limit core file size:

Following command will help to check core file limit

#ulimit –c

Following command is used to change the file limit

#ulimit –c 75000 Note: unit of 75000 is bytes

The above change, done in the way, will not be permanent. To make them permanent, edit file “/etc/security/limits.conf” (You must either be root user or must have “sudo” permission to edit this file.) and type the following line:

* soft core unlimited

Here “*” states that, this change is applicable for all users. However, to make this change for only a specific user, you should enter as follows:

soft core unlimited

Enabling core dump for specific deamon:

Append following into file edit /etc/init.d/ApplicationScript

# -c unlimited >/dev/null 2>&1

Note: After configuration reload the settings in /etc/sysctl.conf by running the following command:

#sysctl –p

OR

Reboot system

Analyzing core dump:

Use following command to analyze core dump:

Gdb executable-name corefile-name

Note: To view/get stack "bt" command can be used which stands for (back track).