Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
CORE(5)			  FreeBSD File Formats Manual		       CORE(5)

     core -- memory image file format

     #include <sys/param.h>

     A small number of signals which cause abnormal termination	of a process
     also cause	a record of the	process's in-core state	to be written to disk
     for later examination by one of the available debuggers.  (See
     sigaction(2).)  This memory image is written to a file named by default
     programname.core in the working directory;	provided the terminated
     process had write permission in the directory, and	provided the abnormal-
     ity did not cause a system	crash.	(In this event,	the decision to	save
     the core file is arbitrary, see savecore(8).)

     The maximum size of a core	file is	limited	by the RLIMIT_CORE
     setrlimit(2) limit.  Files	which would be larger than the limit are not

     With a large limit, a process that	had mapped a very large, and perhaps
     sparsely populated, virtual memory	region,	could take a very long time to
     create core dumps.	 The system ignores all	signals	sent to	a process
     writing a core file, except SIGKILL which terminates the writing and
     causes immediate exit of the process.  The	behavior of SIGKILL can	be
     disabled by setting tunable sysctl(8) variable kern.core_dump_can_intr to

     The name of the file is controlled	via the	sysctl(8) variable
     kern.corefile.  The contents of this variable describes a filename	to
     store the core image to.  This filename can be absolute, or relative
     (which will resolve to the	current	working	directory of the program gen-
     erating it).

     The following format specifiers may be used in the	kern.corefile sysctl
     to	insert additional information into the resulting core filename:
	  %H	      Machine hostname.
	  %I	      An index starting	at zero	until the sysctl debug.ncores
		      is reached.  This	can be useful for limiting the number
		      of corefiles generated by	a particular process.
	  %N	      process name.
	  %P	      processes	PID.
	  %S	      signal during core.
	  %U	      process UID.

     The name defaults to %N.core, yielding the	traditional FreeBSD behaviour.

     By	default, a process that	changes	user or	group credentials whether real
     or	effective will not create a corefile.  This behaviour can be changed
     to	generate a core	dump by	setting	the sysctl(8) variable
     kern.sugid_coredump to 1.

     Corefiles can be compressed by the	kernel if the following	item is	in-
     cluded in the kernel configuration	file:
	  options     GZIO

     The following sysctl control core file compression:
	  kern.compress_user_cores	  Enable compression of	user cores.  A
					  value	of 1 configures	gzip(1)	com-
					  pression, and	a value	of 2 config-
					  ures zstd(1) compression.  Com-
					  pressed core files will have a suf-
					  fix of `.gz' or `.zst' appended to
					  their	filenames depending on the se-
					  lected format.
	  kern.compress_user_cores_level  Compression level.  Defaults to 6.

     Corefiles are written with	open file descriptor information as an ELF
     note.  By default,	file paths are packed to only use as much space	as
     needed.  However, file paths can change at	any time, including during
     core dump,	and this can result in truncated file descriptor data.

     All file descriptor information can be preserved by disabling packing.
     This potentially wastes up	to PATH_MAX bytes per open fd.	Packing	is
     disabled with
	   sysctl kern.coredump_pack_fileinfo=0.

     Similarly,	corefiles are written with vmmap information as	an ELF note,
     which contains file paths.	 By default, they are packed to	only use as
     much space	as needed.  By the same	mechanism as for the open files	note,
     these paths can also change at any	time and result	in a truncated note.

     All vmmap information can be preserved by disabling packing.  Like	the
     file information, this potentially	wastes up to PATH_MAX bytes per	mapped
     object.  Packing is disabled with
	   sysctl kern.coredump_pack_vmmapinfo=0.

     In	order to store all core	images in per-user private areas under
     /var/coredumps, the following sysctl(8) command can be used:

	   sysctl kern.corefile=/var/coredumps/%U/%N.core

     gdb(1), gzip(1), kgdb(1), setrlimit(2), sigaction(2), sysctl(8)

     A core file format	appeared in Version 1 AT&T UNIX.

FreeBSD	13.0			October	5, 2021			  FreeBSD 13.0


Want to link to this manual page? Use this URL:

home | help