Unknown Core generated under "/" on HP-UX 11.31

[Abhilash_CMS]

Hi,

   On our customer system with HP-UX 11iV3 , a core file is generated under  "/".

    But i am not able to get any information of the core , "file core" command is not showing which process has generated the core .

#file core
core: ELF-32 core file - IA64

How can i findout which program has generated this core ? 

Also attaching the "strings core" output.

Regards

Abhilash

[Dennis Handly]

>How can I find out which program has generated this core? 

Why do you care?  Just remove it and move on.  If nobody confesses to owning or caring about it, why should you?

How old is it?  What is it's size?

What does this show:

elfdump -o -S core

It seems the core was truncated.

At the end it has these strings:

../../snmpd/shared/dosnmpv3.c
snmpdm: SrDoSnmp: SNMPv2 request in v1 packet ?

/etc/srconf/agt/snmpd.cnf
/etc/srconf/agt/snmpd.jnk
_=/usr/sbin/snmpdm

So it looks like: /usr/sbin/snmpdm

HP OpenView EMANATE Agent Version 16.1.4.3
Copyright 1989-2005 Hewlett-Packard Development Company, LP.

[Abhilash_CMS]

Hello Dennis,

     I am not worried about the core , but on customer setup its creating problem because the root filesystem is getting full when the core is generated. Customer is behind me...:)

  Following is the output of the command which you requested.

INP ocsdt10:/u01/backup/TSF-PM00015632-RootFileSystem-Full#elfdump -o -S core

core:

*** Program Header ***

Type Offset Vaddr FSize Memsz

NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000
NULL 00000000 00000000 00000000 00000000

Regards

Abhilash

[Dennis Handly]

>on customer setup its creating problem because the root filesystem is getting full when the core is generated.

Well, if you don't want them, you can do:

1) mkdir /core

2) coreadm(1m) to redirect corefiles to another location.

3) ulimit -c to limit corefile size.

The first is probably easiest.

>  Following is the output of the command which you requested.
>NULL 00000000 00000000 00000000 00000000

The file has been truncated, so next to useless.

[Abhilash_CMS]

Thanks Dennis...:) , i will try it.

[Abhilash_CMS]

Hello Dennis,

    I used the coreadm command to set the global core file path. The output shows like below.

    Will it redirect all the cores generated by the proecesses to the defined path ? 

# coreadm

    global core file pattern: /var/adm/core/core.%p.%n.%f

  init(1M) core file pattern:

           global core dumps: disabled

      per-process core dumps: enabled

     global setid core dumps: disabled

per-process setid core dumps: disabled

#

  Does it require system reboot to make this changes to effect , or am i missing something here ?

  Still the cores are generated under  "/".

Thanks and Regards

Abhilash

[Dennis Handly]

>global core dumps: disabled

>Does it require system reboot to make this changes to effect?

No reboots required.  I assume you need to enable the "global core dumps".