Understanding Core Dumps in Linux

A core dump is a snapshot of a program’s state at the moment it crashes, containing the complete contents of its allocated memory. This valuable debugging tool helps developers identify and fix program failures by providing detailed information about the program’s state at the time of the crash.

What is a Core Dump?

When a program crashes unexpectedly, the operating system can save a copy of the program’s memory contents (including stack and heap) to disk as a core dump file. This file contains crucial information such as:

• Program counter and stack pointer values
• Memory segments and their contents
• Register values
• Thread information
• System call trace
• Signal information that caused the crash

Common Causes of Core Dumps

Programs may generate core dumps for several reasons:

• Segmentation faults (accessing invalid memory)
• Buffer overflows
• Stack overflows
• Unhandled exceptions
• Hardware-related issues
• Memory corruption
• Operating system incompatibilities
• Resource exhaustion

Enabling Core Dumps in Linux

Follow these steps to enable core dump generation on your Linux system:

1. Set the soft limit for core dumps to unlimited:

   ulimit -S -c unlimited
   

2. Make the setting permanent by adding the following line to /etc/security/limits.conf:

   * soft core unlimited
   

3. Configure the core dump pattern and location by adding these lines to /etc/sysctl.conf:

   kernel.core_pattern = /var/cores/core-%e-%s-%u-%g-%p-%t
   fs.suid_dumpable = 2
   

The pattern variables represent:

• %e: executable name
• %s: signal number
• %u: user ID
• %g: group ID
• %p: process ID
• %t: timestamp

1. For systems using systemd, enable core dumps by editing /etc/systemd/system.conf:

   DefaultLimitCORE=infinity
   

2. Apply the changes:

   sysctl -p
   systemctl daemon-reload  # if using systemd
   

Analyzing Core Dumps

To analyze core dumps, you’ll need the GNU Debugger (GDB). Install it using your distribution’s package manager:

On Red Hat/CentOS:

sudo dnf install gdb

On Ubuntu/Debian:

sudo apt install gdb

Basic GDB Analysis

1. Load the core dump:

   gdb /path/to/program /path/to/core-dump
   

2. Common GDB commands for analysis:

   (gdb) bt         # Show backtrace
   (gdb) frame N    # Examine specific stack frame
   (gdb) info reg   # Display register values
   (gdb) x/x $sp   # Examine memory at stack pointer
   

Best Practices

1. Create a dedicated directory for core dumps with appropriate permissions
2. Implement log rotation for core dumps to manage disk space
3. Consider using tools like systemd-coredump for automated core dump handling
4. Set appropriate size limits to prevent disk space exhaustion
5. Ensure debug symbols are available for effective analysis

See Also

• Linux Core Dump Documentation
• GDB Documentation
• System Security Services Daemon Configuration