A blog for Linux Lovers.

Posted by sibu on May 24, 2009

Core Dump files..

A core file is created when a program terminates unexpectedly, due to a bug, or a violation of the operating system’s or hardware’s protection mechanisms. The operating system kills the program and creates a core file that programmers can use to figure out what went wrong. It contains a detailed description of the state that the program was in when it died. If would like to determine what program a core file came from, use the file command, like this: $ file core That will tell you the name of the program that produced the core dump. You may want to write the maintainer(s) of the program, telling them that their program dumped core. To Enable or Disable Core Dumps you must use the ulimit command in bash, the limit command in tcsh, or the rlimit command in ksh. See the appropriate manual page for details. This setting affects all programs run from the shell (directly or indirectly), not the whole system. If you wish to enable or disable core dumping for all processes by default, you can change the default setting in /usr/include/linux/sched.h. Refer to definition of INIT_TASK, and look also in /usr/include/linux/resource.h. PAM support optimizes the system’s environment, including the amount of memory a user is allowed. In some distributions this parameter is configurable in the /etc/security/limits.conf file.

Whether or not the operating system creates core files is controlled by the ulimit command. To see the current ulimit setting for core files, do the following:

#ulimit -c

#ulimit -a
core file size (blocks, -c) 1000000
data seg size (kbytes, -d) unlimited
file size (blocks, -f) unlimited
pending signals (-i) 1024
max locked memory (kbytes, -l) 32
max memory size (kbytes, -m) unlimited
open files (-n) 4096
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 14335
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited

If you don’t want core files at all, set “ulimit -c 0″ in your startup files. That’s the default on many systems; in /etc/profile you may find

ulimit -S -c 0 > /dev/null 2>&1

If you DO want core files, you need to reset that in your own .bash_profile:

ulimit -c 50000

would allow core files but limit them to 50,000 bytes.

The ulimit command sets limits on the resource available to the bash shell. The -c parameter controls the size of core files. The value 0 indicates that core files are not created. To enable core file creation, increase the size limit of core files to a number greater than zero. For example:

#ulimit -c 50000

You may also check in the file /etc/csh.cshrc for the following:

limit coredumpsize 0

This will limit the size of the largest core dump that will be created to 0 bytes.

But very imp step is as follows:

First you hash the following line in /etc/profile.

ulimit -S -c 0 > /dev/null 2>&1

Then in the file /etc/security/limits.conf , add the following line:

root soft core 10000

as you can see below:


#* soft core 0
#* hard rss 10000
#@student hard nproc 20
#@faculty soft nproc 20
#@faculty hard nproc 50
#ftp hard nproc 0
#@student - maxlogins 4
root soft core 10000

Instead of root we can give any user as juni, junitha etc…. We will have to either reboot or log off for these changes to take effect. Only if we unhash it in /etc/profile ,we can change these.

You have more control of core files in /proc/sys/kernel/

For example, you can do eliminate the tagged on pid by

echo “0″ > /proc/sys/kernel/core_uses_pid

Core files will then just be named “core”. People do things like that so that a user can choose to put a non-writable file named “core” in directories where they don’t want to generate core dumps. That could be a directory (mkdir core) or a file (touch core;chmod 000 core). One way to limit core file generation is to create a directory called “core” with 000 permissions in the directory in which you expect a core dump to occur.
But perhaps more interesting is that you can do:

mkdir /tmp/corefiles
chmod 777 /tmp/corefiles
echo “/tmp/corefiles/core” > /proc/sys/kernel/core_pattern

All corefiles then get tossed to /tmp/corefiles (don’t change core_uses_pid if you do this).

Test this with a simple script:

# script that dumps core
kill -s SIGSEGV $$

Add A Comment