corefiles

[Andi Rigauer]

Hi Out there,

How can under HP-UX 11i the generation of core files, i.e. when a process dumps core, be controlled ?
( core file name as well as file location)
BRGDS
and thanks in advance

Andi

[Paula J Frazer-Campbell]

Hi Andi

The process that dumps a core files does so in the directory that it is currently working in and will by default dump it as "core".

As you are aware these files can be analysed to identify how they were caused.

Core file are more often that not results of incorrect code in programs and as such should be looked at and the results passed either to your development team or software supplier.

A way to prevent core file generation in certain directories is to mkdir "core" in that dir.


Paula

[T G Manikandan]

Core file generation is good that it points out that the application has some problems.
There are lot of patches for application and OS for to eliminate the core files.

If this is a program built in by the user then the user has to examine the code.
Probably you can start with debugging the core files for the source of origin.

HPux has a lot of debuggers like gdb,wgb to trace the core dumps and to debug them.

If you really want to stop them then probably you can do a
ulimit -c 0
which sets the value of core files size to 0 and will stop generating files.

The best way would be to find out the source,patch things properly and eliminate them.
Try using the debuggers.


Thanks

[T G Manikandan]

Also check this debugger link

http://devresource.hp.com/devresource/Tools/wdb/doc/guide/index.html

[Pete Randall]

Andi,

Rather than prevent their creation, we choose to remove them after a suitable "debugging period" has passed with a simple find command that runs nightly via cron:

00 02 * * * /usr/bin/find / -name "core" -mtime +2 -exec rm {} \;

Pete

[Bill Hassell]

To eliminate core files as a default setting, you can modify /etc/profile (and /etc/csh.login, et al for non-standard shells) by setting the ulimit value. NOTE: ksh does not support options for ulimit!

Put this in /etc/profile:

ulimit -Sc 0

Now every user will no longer have any core files created (assumes that the default POSIX shell is the user's login shell). However, someone who needs core files (a programmer for instance) can turn them on again by typing:

ulimit -c 123456

or whatever limit to the maximum size is needed. Note also that this applies only to users that login, not cron or daemons, etc.

It's probably a good idea to identify the source of the core file as it indicates there is a big problem with the program. Use the command:

file core

to decode the core file.

[Rick Beldin · Accepted solution]

Since all processes dump to a file named 'core', this can pose a problem in debugging if you have a chain of processes that all dump core after the first one does. You wanted the first core, but you got the last one.

On 11.x, there is a kernel param, core_addpid, which will change the name of the core file to core.pid, where pid is the pid of the process that created the core.

To enable this dynamically:

echo "cored_addpid/w 1" | adb -w /stand/vmunix /dev/kmem

[Tom Danzig]

If you're running posix shell (/usr/bin/sh), put this in your .profile if you want to eliminate core dumps altogether:

ulimit -c 0