What is a file called "core"

What is a file called "core"

Post by Kevin Latendress » Fri, 16 Jul 1999 04:00:00



Sometimes I'm in a directory using the GNOME file manager
included with RedHat 6.0 and I see a red colored file called
"core". Is this the result of a "core dump"? I've heard the term
used before but really don't understand how it's produced.
Is it a file which is produced as a result of something
going wrong? I usually delete it when I see it. Should I? Can this
file be analysed to figure out problems.
 
 
 

What is a file called "core"

Post by bkrrrr » Fri, 16 Jul 1999 04:00:00



> Sometimes I'm in a directory using the GNOME file manager
> included with RedHat 6.0 and I see a red colored file called
> "core". Is this the result of a "core dump"?

  You got it.  If you're keeping your man pages
updated, type "man core" for the lowdown.

Quote:> I've heard the term
> used before but really don't understand how it's produced.
> Is it a file which is produced as a result of something
> going wrong?

  Yes - on total meltdown yer program may
hack up a hairball...uh, core.  Analysis
of the hairball...uh, core...can give you
a clue as to the program's "diet" and mental
state at the time of implosion.

Quote:> I usually delete it when I see it. Should I?

  Go for it.

Quote:> Can this file be analysed to figure out problems.

  That's the intent.  You can scan the core to see
exactly what was going on when your program crashed.  
However that's beyond most people's experience or interest
level - for most people they just eat up disk space.

happy core hunting,
                 bkr

 
 
 

What is a file called "core"

Post by Tomasz Koryck » Fri, 16 Jul 1999 04:00:00



> Sometimes I'm in a directory using the GNOME file manager
> included with RedHat 6.0 and I see a red colored file called
> "core". Is this the result of a "core dump"?

Yes.

Quote:>I've heard the term
> used before but really don't understand how it's produced.
> Is it a file which is produced as a result of something
> going wrong?

Yes. Long time ago, memory was a magnetic "core" (in the most primitive
case: a cylindrical mesh with little magnetic toroids all over, each of
which was individually addressable and could be "1" or "0"). Thence the
name. In those times, machines were _very_ sigle-tasking. So, when
something went wrong, there was a facility to "dump" the contents of
memory to some secondary storage - hence "core dump". Nowadays, it's not
the whole "core", but only the memory claimed by the process that goes
astray. Since the process has to know how it got where it is, all that
info is in memory. When it gets dumped, with skill, determination and
madness, You too can find it out. You can look at how You got there,
what were the values of variables, etc., etc. It's useful, if it has to
be.

But.....

Quote:>I usually delete it when I see it. Should I?

Unless You _know_ You shouldn't, You'd better. It's only useful for
post-mortem analisys. If You're not into that kind of thing, it's only
useful to Your hard drive purveyor.

Quote:>Can this
> file be analysed to figure out problems.

Yes, it can. But You seem a touch too sane for me to do that...;)
 
 
 

What is a file called "core"

Post by Liam Whale » Fri, 16 Jul 1999 04:00:00


Here is my not so expert explanation.  When a binary file is running in
the kernel and it does something that would comprimise the integrity of
the OS the kernel kills the program and dumps its current state (all the
code relating to that binary that can be found in its memory space) into
a file called core.  It is safe to delete core files.  In fact I believe
using find on your system to check for core files every few months is a
good idea.  The core file can be examined to determine what went wrong
but it takes a lot more skill than I have.  Did I get that right?

Liam


> Sometimes I'm in a directory using the GNOME file manager
> included with RedHat 6.0 and I see a red colored file called
> "core". Is this the result of a "core dump"? I've heard the term
> used before but really don't understand how it's produced.
> Is it a file which is produced as a result of something
> going wrong? I usually delete it when I see it. Should I? Can this
> file be analysed to figure out problems.

 
 
 

What is a file called "core"

Post by Konstantopoulos » Fri, 16 Jul 1999 04:00:00




> >I usually delete it when I see it. Should I?
> Unless You _know_ You shouldn't, You'd better. It's only useful for
> post-mortem analisys. If You're not into that kind of thing, it's only
> useful to Your hard drive purveyor.

you might as well avoid having to delete by hand the whole time.

assuming that you indeed have no intention to bother and these core
dumps have a `favourite' directory, you might as well make a link to
/dev/null:

# cd /that/*y/directory
# ln -s /dev/null core

this way any attempt to write a core dump in that directory will get
redirected to the null device, a `sink' that swallows files _much_
faster than writing to your hard drive. this way the applications that
crash will die faster: there is no point in waiting for -sometimes-
mb's to be written to your drive so that you can subsequently remove
them!

stasinos

 
 
 

What is a file called "core"

Post by Elchonon Edelso » Fri, 16 Jul 1999 04:00:00


[snip]

Quote:

> # cd /that/*y/directory
> # ln -s /dev/null core

> this way any attempt to write a core dump in that directory will get
> redirected to the null device, a `sink' that swallows files _much_
> faster than writing to your hard drive. this way the applications that
> crash will die faster: there is no point in waiting for -sometimes-
> mb's to be written to your drive so that you can subsequently remove
> them!

> stasinos

There's a much better way to do this. As far as I know, all shells
support resource limits. In bash, for example, you would do "ulimit -c
0"
to limit the maximum core size to zero, which would prevent them from
being created altogether. Put that line into /etc/profile to cause a
global effect.

--

IntelliSoft Corp.       http://www.veryComputer.com/

 
 
 

What is a file called "core"

Post by d.. » Fri, 16 Jul 1999 04:00:00


to see what caused the core file from the command line in the relevant
directory use

gdb -core core

In redhat 6.0 most of the cores seem to come from Gnome. Updating to
the latest rh6 rpm's on the Gnome site has stopped the appearence of
most of them on my system.

Also upgrade enlightenment that fixes a few more little niggles.

Its also a great opportunity to discover how easy rpm is to use

Sent via Deja.com http://www.deja.com/
Share what you know. Learn what you don't.

 
 
 

What is a file called "core"

Post by Gary Smit » Fri, 16 Jul 1999 04:00:00


Yes, that's essentially correct.

All types of UNIX do this but core files are essentially useless to non
developers, they just end up wasting disk space and making non-technical
users think "what are all these stupid core files doing in my directories ?"

Developers should of coarse make programs that don't ever crash and core
dump but when creating complex multi threaded programs that use several
different component libraries, this can be pretty much impossible.

Should it be possible to configure the kernel so that core files are not
produced  ? I would think that the average user would prefer this to be the
case.

Gary


> Here is my not so expert explanation.  When a binary file is running in
> the kernel and it does something that would comprimise the integrity of
> the OS the kernel kills the program and dumps its current state (all the
> code relating to that binary that can be found in its memory space) into
> a file called core.  It is safe to delete core files.  In fact I believe
> using find on your system to check for core files every few months is a
> good idea.  The core file can be examined to determine what went wrong
> but it takes a lot more skill than I have.  Did I get that right?

> Liam


> > Sometimes I'm in a directory using the GNOME file manager
> > included with RedHat 6.0 and I see a red colored file called
> > "core". Is this the result of a "core dump"? I've heard the term
> > used before but really don't understand how it's produced.
> > Is it a file which is produced as a result of something
> > going wrong? I usually delete it when I see it. Should I? Can this
> > file be analysed to figure out problems.

 
 
 

What is a file called "core"

Post by Keith Rhode » Fri, 16 Jul 1999 04:00:00


You can use the gnu de* to see what program dumped the
core file, and sometimes this can provide clues as to what
is going wrong...

Type this: gdb -c core

Type a q to quit the de*.

If (by some strange chance) you have a commercial
application and you get some kind of technical support worth
the name, the technical support team might ask to see a copy
of the core, or at least what caused the dump (e.g.,
segmentation fault, bus error, etc.).

Apart from that, there's not much reason for keeping core
files.

Keith.