How to set the pattern of core file

Sometimes, when application’s going wrong, core files are created. This is useful for the debugging purpose.

If you want to make core file with the ‘core.%pid’ format, you should set the following parameters in the sysctl configuration.


kernel.core_pattern = core
kernel.core_uses_pid = 1

You also need to change the limit of the core file size using ulimit command.


ulimit -c 3000
ulimit -a

This makes limits of core file size to the 3000 blocks.

You can easily make core dumps for the running application if you want to check the setting.


xterm &
rm -f core*
kill -SEGV %1
ls core*

There are one issue with the kernel.core_pattern parameter. It lets the kernel to determine if will use pid as a part of the filename. If this parameter is set to 1, it will end with pid. If it is 0, it should not end with PID.

But, sometimes you will see the pid whether or not set the kernel.core_pattern parameter as a 0. It actually is not a BUG. It is only happened when the application is threaded.

You can see this issue on the kernel news list (http://bugzilla.kernel.org/show_bug.cgi?id=6312).

You can see the code which related to this issue in format_corename() function (http://lxr.linux.no/linux+v2.6.27/fs/exec.c#L1394).


1496 /* Backward compatibility with core_uses_pid:
1497 *
1498 * If core_pattern does not include a %p (as is the default)
1499 * and core_uses_pid is set, then .%pid will be appended to
1500 * the filename. Do not do this for piped commands. */
1501 if (!ispipe && !pid_in_pattern
1502 && (core_uses_pid || nr_threads)) {
1503 rc = snprintf(out_ptr, out_end - out_ptr,
1504 ".%d", task_tgid_vnr(current));
1505 if (rc > out_end - out_ptr)
1506 goto out;
1507 out_ptr += rc;
1508 }

Leave a Comment

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.