core
—
memory image file format
#include
<sys/param.h>
A small number of signals which cause abnormal termination of a process also
cause a record of the process's in-core state to be written to disk for later
examination by one of the available debuggers. (See
sigaction(2).)
This memory image is written to a file named by default
programname.core
in the working directory;
provided the terminated process had write permission in the directory, and
provided the abnormality did not cause a system crash. (In this event, the
decision to save the core file is arbitrary, see
savecore(8).)
The maximum size of a core file is limited by
setrlimit(2).
Files which would be larger than the limit are not created.
The name of the file is controlled via the
sysctl(8)
variable
kern.corefile. The contents of this
variable describes a filename to store the core image to. This filename can be
absolute, or relative (which will resolve to the current working directory of
the program generating it).
The following format specifiers may be used in the
kern.corefile sysctl to insert additional
information into the resulting core filename:
- %H
- Machine hostname.
- %I
- An index starting at zero until the sysctl
debug.ncores is reached. This can be useful
for limiting the number of corefiles generated by a particular
process.
- %N
- process name.
- %P
- processes PID.
- %U
- process UID.
The name defaults to
%N.core, yielding the
traditional
FreeBSD behaviour.
By default, a process that changes user or group credentials whether real or
effective will not create a corefile. This behaviour can be changed to
generate a core dump by setting the
sysctl(8)
variable
kern.sugid_coredump to 1.
Corefiles can be compressed by the kernel if the following item is included in
the kernel configuration file:
The following sysctl control core file compression:
- kern.compress_user_cores
- Enable compression of user cores. A value of 1 configures
gzip(1)
compression, and a value of 2 configures
zstd(1)
compression. Compressed core files will have a suffix of
‘
.gz
’ or
‘.zst
’ appended to their filenames
depending on the selected format.
- kern.compress_user_cores_level
- Compression level. Defaults to 6.
Corefiles are written with open file descriptor information as an ELF note. By
default, file paths are packed to only use as much space as needed. However,
file paths can change at any time, including during core dump, and this can
result in truncated file descriptor data.
All file descriptor information can be preserved by disabling packing. This
potentially wastes up to PATH_MAX bytes per open fd. Packing is disabled with
sysctl
kern.coredump_pack_fileinfo=0.
Similarly, corefiles are written with vmmap information as an ELF note, which
contains file paths. By default, they are packed to only use as much space as
needed. By the same mechanism as for the open files note, these paths can also
change at any time and result in a truncated note.
All vmmap information can be preserved by disabling packing. Like the file
information, this potentially wastes up to PATH_MAX bytes per mapped object.
Packing is disabled with
sysctl
kern.coredump_pack_vmmapinfo=0.
In order to store all core images in per-user private areas under
/var/coredumps, the following
sysctl(8)
command can be used:
sysctl
kern.corefile=/var/coredumps/%U/%N.core
gdb(1),
gzip(1),
kgdb(1),
setrlimit(2),
sigaction(2),
sysctl(8)
A
core
file format appeared in
Version 6 AT&T UNIX.