How to set process core file names

Solution Unverified - Updated -

Environment

  • Red Hat Enterprise Linux 4, 5, 6, 7

Issue

  • For easier coredumps debugging, there is a request to have executable file name as a part of core files.
  • There is an external solution publicly available suggesting to use kernel.core_name_format tunable, but using this tunable ends up with an error message:
# sysctl -w "kernel.core_name_format=%N-%P.core"
error: "kernel.core_name_format" is an unknown key

Resolution

In current linux kernels, the kernel.core_pattern tunable is used to define a file name for core dumps. According to the core(5) man page, the following specifiers can be used:

%%  a single % character
%p  PID of dumped process
%u  (numeric) real UID of dumped process
%g  (numeric) real GID of dumped process
%s  number of signal causing dump
%t  time of dump, expressed as seconds since the Epoch (00:00h, 1 Jan 1970, UTC)
%h  hostname (same as nodename returned by uname(2))
%e  executable filename (without path prefix)
%c  core file size soft resource limit of crashing process (since Linux 2.6.24)

The sysctl command is used to configure run time kernel parameters. To set the kernel.core_pattern immediately, the following command should be run:

# sysctl -w kernel.core_pattern="%e-%t.core"

Another way is to add a line

kernel.core_pattern="%e-%t.core"

to /etc/sysctl.conf to have the change permanent and run

# sysctl -p

to make all configured changes to the live kernel.

In addition to this, when the kernel.core_uses_pid tunable is set to 1, core files will have a executable process id as a filename suffix. When both the tunables are configured, the core file name can look like EXECUTABLE-TIME.core.PID.

More information about kernel runtime parameters can be found in the core(5) man page or at the linux kernel website.

Root Cause

In older versions of Linux kernel, the kernel.core_name_format tunable was used to specify the filename for core dumps. This tunable doesn't exist in newer RHEL kernels any more. It was renamed to kernel.core_pattern and has more features than it used to have.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments