Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What use is a truncated coredump?

ulimit -c can be used to set RLIMIT_CORE, and limit the maximum size of a coredump a process may generate. Any larger coredump will be truncated to this size.

Can anything useful be done with such a truncated coredump? Perhaps on a platform other than Linux x86-64, or with a debugger other than GDB?

If not, why does POSIX specify this behavior, rather than, say, truncating a coredump to zero bytes if RLIMIT_CORE is exceeded?

like image 401
daxelrod Avatar asked Dec 12 '11 21:12

daxelrod


1 Answers

Can anything useful be done with such a truncated coredump?

Yes, lots of things.

The truncated core dump will usually contain the stack segments, so the commands where and thread apply all where will usually work. Often that's all one needs from a core. Commands to examine local variables and globals will likely work as well.

Commands to examine heap-allocated variables may work for some variables, but not necessarily for others. Still, this is much better than nothing.

like image 118
Employed Russian Avatar answered Nov 03 '22 21:11

Employed Russian