Very Computer

We are working on a post-mortem de* and have run into a number of
difficulties involving core files and code that creates and manages its
own stacks.  I have noticed other requests for information on core files but
never seen a response.  Surely there are some docs on core file somewhere...

We have run into cases where the core files seem very incomplete.  They
are typically ~150k.  We suspect that the code responsible for dumping core
is getting confused, but we cannot tell.  It would seem that any thread
package that isn't kernel supported would have this problem.  Anyone
else seen this?

--
 ----------------------------------------------------------------------------
| David T. Croley | MCC - Exp Sys Lab | *space:                          |

|    PGP key available on request     | A ghost unseen...the world "between".|
 ----------------------------------------------------------------------------

: We are working on a post-mortem de* and have run into a number of
: difficulties involving core files and code that creates and manages its
: own stacks.  I have noticed other requests for information on core files but
: never seen a response.  Surely there are some docs on core file somewhere...

[ etc. etc. ]

For System V

Quoting from the manual core(4)

The first section of the core image is a copy of the system's per-user
data for the process, including the registers as they were at the time
of the fault. The size of this section depends on the parameter usize,
which is defined in /usr/include/sys/param.h. The remainder represents
the actual contents of the of the user's core area when the core image
was written. If the text segment is read only and shared or separated
from data space it is not dumped.

The format of the information in the first section is described by the
user structure of the system, defined in /usr/include/sys/user.h The
important stuff not detailed therein is the location of the registers,
which are outlined in /usr/include/sys/reg.h.

It would seem that the last sentence of the first paragraph is the one to note.
By the way, some say that literacy has no harmful side effects {:-)=

--
 +-------------------------------------+
 | NAME   Christopher Sawtell          |

 | PHONE  +64-3-389-3200               |
 +-------------------------------------+

Quote:>For System V

>Quoting from the manual core(4)

If the original poster is using SunOS 3.0 or later, the core dump files
aren't in the "traditional" UNIX format used in pre-SVR4 SV systems,
they're in a newer format.

SunOS 3.x and 4.x have a core dump header, not a copy of the U area, at
the beginning of the core file; see CORE(5) and <sys/core.h>.

SunOS 5.x uses the standard SVR4 scheme for core files; the core file is
in ELF format (yup, the ELF format that's also used for object files,
executables, etc.).  See "core(4)".