What use is a truncated coredump?

Question

ulimit -c can be used to set RLIMIT_CORE, and limit the maximum size of a coredump a process may generate. Any larger coredump will be truncated to this size.

Can anything useful be done with such a truncated coredump? Perhaps on a platform other than Linux x86-64, or with a debugger other than GDB?

If not, why does POSIX specify this behavior, rather than, say, truncating a coredump to zero bytes if RLIMIT_CORE is exceeded?

Answer 1

Can anything useful be done with such a truncated coredump?

Yes, lots of things.

The truncated core dump will usually contain the stack segments, so the commands where and thread apply all where will usually work. Often that's all one needs from a core. Commands to examine local variables and globals will likely work as well.

Commands to examine heap-allocated variables may work for some variables, but not necessarily for others. Still, this is much better than nothing.