Core File

發表於
文章字數： 2k 所需閱讀時間 ≈ 4 分鐘

Core File

  • In most GNU/Linux systems (all of those I personally have used, at least), core dump files generated after an uncaught signal in a process (as a SIGSEGV or SIGQUIT), are generated in the base directory where the program was executed, and named as “core” or “core.PID”.
  • 會產生core檔案，可用gdb來看此檔
  • For example: 
    1
    2
    3
    4
    $> cd /home/user  

    $> ulimit -c unlimited  
    $> kill -s SIGSEGV $$
    • ulimit -c:用來看core dump寫入的容量限制
    • Ubuntu 預設為 ulimit -c 0，表示不產生 core dump
    • This will trigger a segmentation fault in your current shell (you probably guessed it after seeing that the shell session where you executed it was closed), and generate a core file in: /home/user/core
  • the kernel configuration includes a file named “core_pattern”
    • /proc/sys/kernel/core_pattern

Here is a small list of possible variables

1
2
3
4
5
6
7
8
9
10
%p:       pid
%<NUL>:   '%' is dropped  
%%:       output one '%'  
%u:       uid  
%g:       gid  
%s:       signal number  
%t:       UNIX time of dump  
%h:       hostname  
%e:       executable filename  
%<OTHER>: both are dropped
  • core pattern 可以是 “|PROGRAM”, 這樣會將 core dump 導到 PROGRAM 的標準輸入, 可以自己寫 PROGRAM 做控制
  • 需要特別注意的是, | 和 PROGRAM 之間不可以有空白。

tools

  • gdb
  • dbx
  • pstack
    • $ pstack ${core_file} > pstack.out
  • pmstack

用gdb看core檔

1
2
3
4
5
6
7
gdb <executable> <core-file>
# or
gdb <executable> -c <core-file> or
# or
gdb <executable>
...
(gdb) core <core-file>
  • 首先先找到當時 core dump 出來的 core 檔案 ( 跟執行的binary 同資料夾 )
    1
    11781124 11月 27日 17:23 core
  • 接下來用 gdb 來看這個 core file
    1
    gdb executefile core
  • 舉例來說 我有一個叫 Close 的程式執行的時後會發生 core dump，就這樣做
    1
    gdb Close core
    • 要同時放入 程式的執行檔 和 core file

trace stack

  • process the core file
  • check timestamp of the failure
  • check the active threads at the time of the failure
  • how to review the steps leading up to the failure

reference