topic Find Core and the process generated it in Operating System - HP-UX

Find Core and the process generated it

Global Service Desk — Mon, 20 Feb 2006 01:49:40 GMT

HI Friends,

i coudnt find any pointer to the following problem which i have been working for some time.

1. Find the core files in system and move it central location,
2. How to find what process generated this core file.

Its been asked by our team members, but i am running out of things. if anybody has any script please help me out.

THanks In advance

BestRegards,
Govind,

Re: Find Core and the process generated it

Muthukumar_5 — Mon, 20 Feb 2006 01:52:52 GMT

1. Find the core files in system and move it central location,

# find / -name "core" -exec mv {} \;

2. How to find what process generated this core file.

# file core
# what core

--
Muthu

Re: Find Core and the process generated it

Arunvijai_4 — Mon, 20 Feb 2006 01:55:21 GMT

Hi Govind,

You can find the core files by,

# find / -type f -name "core" and to see which process caused the core by,

# file `find / -type f -name "core"`

You can move all core to any central location if needed, I dont think you have "coreadm" as of solaris.

-Arun

Re: Find Core and the process generated it

Arunvijai_4 — Mon, 20 Feb 2006 01:58:40 GMT

Hi Govind,

A similar thread should help you,

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=898593

-Arun

Re: Find Core and the process generated it

Sivakumar TS — Mon, 20 Feb 2006 01:59:45 GMT

Hi,

#file `find / -type f -name core*`

Should satisfy your requirement.

The above command will search for all core files in the system and give the brief description about its origin.

Regards,

Siva.

Re: Find Core and the process generated it

Global Service Desk — Mon, 20 Feb 2006 02:26:09 GMT

Thanks for the replies,

but how do i move all the core files to one location. for that i need to change the name of the core files right otherwise it will overwrite the existing.

can anyone tell me how do i do that.

i will assign points ...

thanks in advance
GOvinda.

Re: Find Core and the process generated it

Muthukumar_5 — Mon, 20 Feb 2006 02:49:43 GMT

I hope core files are keep on updated based on application. Few applications are creating new core files if some file is named with core available.

If you want to move core files to centralized directory then,

a) You can find all files named with core and move them to that directory

b) Configure application core making location to your centralized place.

I hope first one is very possible as,

# find / -name "core" -exec mv {} \;

--
Muthu

Re: Find Core and the process generated it

Arunvijai_4 — Mon, 20 Feb 2006 02:53:00 GMT

Hi Govind,

but how do i move all the core files to one location. for that i need to change the name of the core files right otherwise it will overwrite the existing.

You can do it, try to use file command which gives which process causes the core, then use that process name as prefix or suffix of the core, then move it to your preferred location.

Its simple and ease of use, may be compared to "creadm" command in solaris. Take a look at the thread which i posted in my previous reply.

-Arun

Re: Find Core and the process generated it

Senthil Kumar .A_1 — Mon, 20 Feb 2006 03:43:22 GMT

Hi Govind,

1) U can use the find command given by Muthukumar to segregate the core files.

2) Make sure you switch on the core file naming convention so as to, it includes the PID in its name, while ists saved. you can do this by doing the following in 11.x and up machines..

echo "core_addpid/W 1\ncore_addpid?W 1" | adb -w -k /stand/vmunix /dev/mem

Note: if u rebuild ur kernel in future, remember to rerun these commands once again.

3) Enable process auditing in you system. To do it. .. refer the "man" page of AUDIT.

man 4 audit
man 5 audit

Final Result:

From the step 2, whenever a core file gets created , u can get 2 infos by Performing "ll" on the core file

a) PID
b) Time of core file creation

From step 3, u will be able to get
a)time of the process execution
b)PID

NOW by mapping the PID from above info's aligned with particular time, you will be able to find, which process Cored while execution.

NOTE: There are programs to analyze core files, like q4 etc...That may be able to get the info's u require without performing the above steps. but I haven't used q4 personally.

Anyway,

Regards,
Senthil Kumar .A

Re: Find Core and the process generated it

Global Service Desk — Mon, 20 Feb 2006 04:13:41 GMT

THanks for all,

I will try all these things and let you know !

THanks
Govinda.

Re: Find Core and the process generated it

Arunvijai_4 — Mon, 20 Feb 2006 04:19:58 GMT

Hi Govind,

This thread should be useful as well,
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=665680

-Arun