Linux core file usage details

preface

In some cases, the program will exit without any logging. In this case, the code file can be used for analysis. It records the memory, registers, stack Pointers and other information of the program

What is an core file

Usually encountered under Linux abnormal program exit or suspended, we'll use core file is analyzed, which includes the application runtime memory, register information such as the stack pointer, the format for ELF, can understand the current status is application work dump into a file, the file through the analysis of the tool, we can locate the abnormal program exit or terminate the appropriate information, such as call stack when to help solve the problem.

Debug with the core file

Generating methods

View the status of the current core file

$ ulimit -a
...
-c: core file size (blocks)   0 #  The closed position 
...

Turn on the generate switch

ulimit -c unlimited
ulimit -a
...
-c: core file size (blocks)   unlimited
...

Limit the size of the core file to blocks, 1 generally 1 block=512 bytes. Setting too small may cause the file not to be generated

$ ulimit -c 1024
$ ulimit -a
...
-c: core file size (blocks)   1024
...

Turn off generation switch

ulimit -c 0
ulimit -a
...
-c: core file size (blocks)   0
...

The above operation on the core file is valid only for the current operation, and if permanent is required, the corresponding operation is written to /etc/profile

Path is generated

The core file is generated by default in the working directory of the program. The build path can be set. You need to ensure that there is enough space for the corresponding directory and have write permission

echo /MyCoreDumpDir/core.%e.%p > /proc/sys/kernel/core_pattern

A list of parameters to use for naming

%p - insert pid into filename #  add  pid 
%u - insert current uid into filename #  Add the current  uid 
%g - insert current gid into filename #  Add the current  gid 
%s - insert signal that caused the coredump into the filename #  Add to produce  core  The signal of  
%t - insert UNIX time that the coredump occurred into filename #  add  core  When the file is generated  unix  time  
%h - insert hostname where the coredump happened into filename #  Add host name  
%e - insert coredumping executable name into filename #  Add command name 

/ proc sys kernel/core_uses_pid this file if value is 1, whenever the time allocation % p, finally will add pid core generated file

Debug method

core files can be debuggable using gdb, which requires the -ES70en option to compile

$ gdb a.out
...
(gdb) core-file core
...
(gdb) bt 
...

If you need to debug core files generated by embedded devices on PC, you need to select the gdb tool of the corresponding platform and set the position of symbol file after entering gdb

$ xxx-xxx-gdb a.out
...
(gdb) solib-search-path xxx.so:xxx.so
...
(gdb) core-file core
...
(gdb) bt
...

conclusion