Sungju's Slow Life

Sometimes, when application’s going wrong, core files are created. This is useful for the debugging purpose.

If you want to make core file with the ‘core.%pid’ format, you should set the following parameters in the sysctl configuration.


kernel.core_pattern = core
kernel.core_uses_pid = 1


You also need to change the limit of the core file size using ulimit command.


ulimit -c 3000
ulimit -a


This makes limits of core file size to the 3000 blocks.

You can easily make core dumps for the running application if you want to check the setting.


xterm &
rm -f core*
kill -SEGV %1
ls core*


There are one issue with the kernel.core_pattern parameter. It lets the kernel to determine if will use pid as a part of the filename. If this parameter is set to 1, it will end with pid. If it is 0, it should not end with PID.

But, sometimes you will see the pid whether or not set the kernel.core_pattern parameter as a 0. It actually is not a BUG. It is only happened when the application is threaded.

You can see this issue on the kernel news list (http://bugzilla.kernel.org/show_bug.cgi?id=6312).

You can see the code which related to this issue in format_corename() function (http://lxr.linux.no/linux+v2.6.27/fs/exec.c#L1394).


1496 /* Backward compatibility with core_uses_pid:
1497 *
1498 * If core_pattern does not include a %p (as is the default)
1499 * and core_uses_pid is set, then .%pid will be appended to
1500 * the filename. Do not do this for piped commands. */
1501 if (!ispipe && !pid_in_pattern
1502 && (core_uses_pid || nr_threads)) {
1503 rc = snprintf(out_ptr, out_end - out_ptr,
1504 ".%d", task_tgid_vnr(current));
1505 if (rc > out_end - out_ptr)
1506 goto out;
1507 out_ptr += rc;
1508 }