Find which program caused a core dump file

Question

I've been going through intense program/package installation recently, so I can't tell for sure which of the newly installed programs (or old programs) caused the appearance of a core file in my home folder. It's a server, so I better find out any possible sources of instability on the machine.

Answer 1

You can simply use the file program to identify them:

E.g

# file /var/core/core /var/core/core:     ELF 64-bit MSB core file SPARCV9 Version 1, from 'crs_stat.bin' 

Answer 2

Often using the file program on the core file will show the errant executable, as explained by @Benj in the accepted answer (code from Benj's answer):

# file /var/core/core /var/core/core:     ELF 64-bit MSB core file SPARCV9 Version 1, from 'crs_stat.bin' 

However, sometimes you may get a complaint about "too many program header sections":

core.some-lib.nnnn.nnnn: ELF 64-bit LSB  core file x86-64, version 1 (SYSV), too many program header sections (1850) 

In this case, you can try some alternatives:

• Tail the last several strings of the corefile (the app was about 25 back for me): strings core.some-lib.nnnn.nnnn | tail -50
• Use gdb itself: gdb -c core.some-lib.nnnn.nnnn This will often tell you something like this: Core was generated by '/usr/local/bin/some-executable'