core dump files on Linux: how to get info on opened files?

Question

I have a core dump file from a process that has probably a file descriptor leak (it opens files and sockets but apparently sometimes forgets to close some of them). Is there a way to find out which files and sockets the process had opened before crashing? I can't easily reproduce the crash, so analyzing the core file seems to be the only way to get a hint on the bug.

Answer 1

If you have a core file and you have compiled the program with debugging options (-g), you can see where the core was dumped:

$ gcc -g -o something something.c $ ./something Segmentation fault (core dumped) $ gdb something core 

You can use this to do some post-morten debugging. A few gdb commands: bt prints the stack, fr jumps to given stack frame (see the output of bt).

Now if you want to see which files are opened at a segmentation fault, just handle the SIGSEGV signal, and in the handler, just dump the contents of the /proc/PID/fd directory (i.e. with system('ls -l /proc/PID/fs') or execv).

With these information at hand you can easily find what caused the crash, which files are opened and if the crash and the file descriptor leak are connected.

Answer 2

Your best bet is to install a signal handler for whatever signal is crashing your program (SIGSEGV, etc.).

Then, in the signal handler, inspect /proc/self/fd, and save the contents to a file. Here is a sample of what you might see:

Anderson cxc # ls -l  /proc/8247/fd total 0 lrwx------ 1 root root 64 Sep 12 06:05 0 -> /dev/pts/0 lrwx------ 1 root root 64 Sep 12 06:05 1 -> /dev/pts/0 lrwx------ 1 root root 64 Sep 12 06:05 10 -> anon_inode:[eventpoll] lrwx------ 1 root root 64 Sep 12 06:05 11 -> socket:[124061] lrwx------ 1 root root 64 Sep 12 06:05 12 -> socket:[124063] lrwx------ 1 root root 64 Sep 12 06:05 13 -> socket:[124064] lrwx------ 1 root root 64 Sep 12 06:05 14 -> /dev/driver0 lr-x------ 1 root root 64 Sep 12 06:05 16 -> /temp/app/whatever.tar.gz lr-x------ 1 root root 64 Sep 12 06:05 17 -> /dev/urandom 

Then you can return from your signal handler, and you should get a core dump as usual.