Introduction and processing of Linux core files

1. A brief introduction to the core file
When a program crashes, it typically generates a core file in the specified directory. The core file is simply a memory image (plus debugging information), which is used primarily for debugging purposes.

2. Turn core file generation on or off
Use the following command to prevent the system from generating a core file:
Ulimit-c 0
The following command checks to see if the option to generate a core file is open:
Ulimit-a
This command will show all user customizations, where option-a stands for "all".

You can also modify the system files to adjust the core options
In/etc/profile there is usually a sentence to prohibit the creation of a core file, which is usually justified:
# No core Files by default
Ulimit-s-C 0 >/dev/null 2>&1
However, in the development process sometimes in order to debug the problem, or need to open the core file in a specific user environment generated by the settings
Add Ulimit-c Unlimited to the user's ~/.bash_profile to allow a specific user to produce a core file
If Ulimit-c 0 is also forbidden to produce core files, ulimit-c 1024 limits the resulting core file size to not exceed 1024kb

3. Set the core dump file directory and the naming convention of the kernel dump
/proc/sys/kernel/core_uses_pid to control whether the resulting core file has a PID extension in the filename, If you add the file content is 1, otherwise 0
/proc/sys/kernel/core_pattern can set the format of the core file save location or file name, such as the original file content is core-%e
can be modified:
echo "/ Corefile/core-%e-%p-%t ">/proc/sys/kernel/core_pattern
will control the resulting core file will be stored in the/corefile directory, The resulting file name is core-command name-pid-timestamp
The following is a list of parameters:
   %p-insert pid into filename add pid
   %u -Insert current UID into filename to add present UID
   %g-insert current GID into filename to add present GID
 &N bsp; %s-insert signal that caused the coredump into the filename adds a signal that leads to core generation
   %t-insert U NIX time that the coredump occurred to filename add a core file when you build Unix times
   %h-insert hostname where the Coredump happened into filename add host name
   %e-insert coredumping executable name into filename add command name

4. Using the core file
In the directory where the core file is located, type:
Gdb-c Core
It will start the GNU debugger to debug the core file, and will show the name of the program that generated the core file, the signal to abort the program, and so on.
If you already know what program generated this core file, such as MyServer crashes generating core.12345, debug with this command:
Gdb-c Core MyServer
Here's how to learn the use of GDB

5. A small way to test the resulting core file
Direct Input Command:
Kill-s SIGSEGV $$

6. sometimes The program is down, but the Core file is not generated .

Under Linux, there are some settings that indicate the resources available to the shell and to processes. can use

#ulimit -A to see these settings. (Ulimit is bash built-in Command)

-A All current limits is reported
-c The maximum size of core files created
-d The maximum size of a processEchnical'sData segment
-e The maximum scheduling priority ("nice")
-F The maximum size of files written by the shell and its children
-I the maximum number of pending signals
-L The maximum size the May is locked into memory
-M The maximum resident set size (have no effect on Linux)
-N The maximum number of open file descriptors (most systems does not allow this value to be set)
-P The pipe size in 512-byte blocks
-Q The maximum number of bytes in POSIX message queues
-R The maximum real-time scheduling priority
-s the maximum stack size
-T the maximum amount of CPU time in seconds
-U The maximum number of processes available to a single user
-V The maximum amount of virtual memory available to the shell
-X The maximum number of file locks

As can be seen here, if-C is displayed:core file size (blocks,-c)

If this value is 0, the core file cannot be generated. So you can use:

#ulimit-C or #ulimit-C Unlimited to enable the core file.

If the program generates a core file when an error occurs, segmentation fault (core dumped)is displayed.

7. Core dump file directory and naming rules :
/proc/sys/kernel/core_uses_pid can control whether a PID is added to the file name of the resulting core file, and if it is added, the content is 1, otherwise 0

8. Anti-push app name and related information

1.ps-ef|grep Bpe/hps to see the restart time of the process

[root]# ps-ef|grep HPS
Root 1966 1 0 Jan19? 00:00:00./hps
Root 1968 1966 0 Jan19? 1-11:31:36./hps
Root 8 251 1 0 Jul23? 00:00:00./hps
Root 8253 8251 0 Jul23? 02:33:17./hps
Root 9225 1 0 Mar26? 00:00:00./hps
Root 9227 9225 0 Mar2 6? 16:17:26./hps
Root 11778 1 0 Mar17? 00:00:00./hps
Root 11780 11778 0 Mar17? 10:03:21./hps
Root 14555 1 0 Jul 14? 00:00:00./hps
Root 14557 14555 Jul14? 3-08:21:30./hps
Root 17573 1 0 May21? 00:00:00./hps
Root 17575 1757 3 0 May21? 02:35:42./hps
Root 18754 1 0 Apr02? 00:00:00./hps
Root 18756 18754 0 Apr02? 04:33:11./hps
Root 21221 1 0 06? 00:00:00./hps
Root 21223 21221 Aug06? 13:39:10/hps
root 24987 1 0 13:45 PTS/1 0 0:00:00./hps
Root 24989 24987 13:45 pts/1 00:06:55./hps
Root 27844 20840 0 14:40 pts/3 00:00:00 grep HPS
Root 31568 1 0 Apr09 00:00:00./hps
Root 31570 31568 1 Apr09? 1-17:20:24./hps

2. View the app through the process number ll/proc/

[root]# ll/proc/24987
Total 0
Dr-xr-xr-x 2 root root 0 14:12 attr
-R--------1 root root 0 14:12 auxv
-r--r--r--1 root root 0 13:45 cmdline
-rw-r--r--1 root root 0 14:12 coredump_filter
-r--r--r--1 root root 0 14:12 cpuset
lrwxrwxrwx 1 root root 0 14:12 cwd--/opt/app/hps4gauth
-R--------1 root root 0 14:12 environ
lrwxrwxrwx 1 root root 0 14:12 exe--/OPT/APP/HPS4GAUTH/HPS
Dr-x------2 root root 0 13:45 FD
Dr-x------2 root root 0 14:12 fdinfo
-R--------1 root root 0 14:12 io
-r--r--r--1 root root 0 14:12 limits
-rw-r--r--1 root root 0 14:12 loginuid
-r--r--r--1 root root 0 14:12 maps
-RW-------1 root root 0 14:12 mem
-r--r--r--1 root root 0 13:45 mounts
-R--------1 root root 0 14:12 mountstats
-r--r--r--1 root root 0 14:12 numa_maps
-rw-r--r--1 root root 0 14:12 Oom_adj
-r--r--r--1 root root 0 14:12 oom_score
lrwxrwxrwx 1 root root 0 14:12 root
-r--r--r--1 root root 0 14:12 schedstat
-r--r--r--1 root root 0 14:12 smaps
-r--r--r--1 root root 0 13:45 stat
-r--r--r--1 root root 0 13:46 Statm
-r--r--r--1 root root 0 13:45 status
Dr-xr-xr-x 3 root root 0 14:12 task
-r--r--r--1 root root 0 14:12 Wchan

This is probably the best way to find out .......

(turn) Linux core file Introduction and processing