How to configure Core dump on a Linux machine

When a program crashes then it may leave a core which can be used to figure out exactly why the program crashed - which is especially useful in case of finding root cause.

Core dumps are disabled by default on many Linux distributions. You need to configure it as per your choice. Here are the easy steps:

Check the Current Linux Core Dump Limits

ulimit is used to specify the maximum size of generated coredumps, this is to stop apps chewing up a million GB of RAM and then blowing your disk up, by default it’s a 0, which means nothing gets written to disk and no dump is created!

LinuxServer:~ # ulimit -c
0

Change The Linux Core Dump Limits To Something Awesome

To set the size limit of the linux core files to unlimited, you can do something like this

LinuxServer:~ # ulimit -c unlimited

Enable Linux Core Dump for Application Crashes and Segfaults and Things

Ok, so we want this to persist across reboots so that basically means we have to stick the ulimit command in /etc/profile, I’m putting this at the bottom of mine:

#corefile stuff
ulimit -c unlimited > /dev/null 2>&1

This will stop anything weird getting spat out to the screen and nicely tells us that its core file stuff.

For our next trick we’ll set some sysctl flags so in /etc/sysctl.conf add

#corefile stuff
kernel.core_uses_pid = 1
kernel.core_pattern = /tmp/core-%e-%s-%u-%g-%p-%t 
fs.suid_dumpable = 2

This basically says when the application crashes create a coredump file in /tmp (you can change with your own directory path but the path should have write permission to all user) with a useful name pattern

1. kernel.core_uses_pid = 1 - add the pid of the crashed app to the filename.
2. fs.suid_dumpable = 2 - enable linux core dumps for setuid processes.
3. kernel.core_pattern = /tmp/core-%e-%s-%u-%g-%p-%t - crazy naming pattern for a successful core dump, here's roughly what all the bits mean:

%e - executable filename
%s - number of signal causing dump
%u - real UID of dumped process
%g - real GID of dumped process
%p - PID of dumped process
%t - time of dump (seconds since 0:00h, 1 Jan 2015)

Then run sysctl -p so it takes effect.

LinuxServer:~ # sysctl -p
<snip>
kernel.core_uses_pid = 1
kernel.core_pattern = /tmp/core-%e-%s-%u-%g-%p-%t
fs.suid_dumpable = 2

Testing Core Dumps

This is easy, we just start the deamon, send a segfault signal, look in the right place!!

LinuxServer:tmp # /etc/init.d/XYZProgram start
LinuxServer:tmp # /etc/init.d/XYZProgram status
XYZProgram (pid 1234) is running...
LinuxServer:tmp # kill -s SIGSEGV 1234
LinuxServer:tmp # ls /tmp/core*
core-XYZProgram-44-234-876-1234-1434354548