Chapter 16 Managing Core Files (Tasks)

This chapter describes how to manage core files with the coreadm command.

For information on the procedures associated with managing core files, see Managing Core Files (Task Map).

Managing Core Files (Task Map)

Managing Core Files Overview

Core files are generated when a process or application terminates abnormally. Core files are managed with the coreadm command.

For example, you can use the coreadm command to configure a system so that all process core files are placed in a single system directory. This means it is easier to track problems by examining the core files in a specific directory whenever a process or daemon terminates abnormally.

Configurable Core File Paths

Two new configurable core file paths that can be enabled or disabled independently of each other are:

• A per-process core file path, which defaults to core and is enabled by default. If enabled, the per-process core file path causes a core file to be produced when the process terminates abnormally. The per-process path is inherited by a new process from its parent process.

  When generated, a per-process core file is owned by the owner of the process with read/write permissions for the owner. Only the owning user can view this file.

• A global core file path, which defaults to core and is disabled by default. If enabled, an additional core file with the same content as the per-process core file is produced by using the global core file path.

  When generated, a global core file is owned by superuser with read/write permissions for superuser only. Non-privileged users cannot view this file.

When a process terminates abnormally, it produces a core file in the current directory by default. If the global core file path is enabled, each abnormally terminating process might produce two files, one in the current working directory, and one in the global core file location.

By default, a setuid process does not produce core files using either the global or per-process path.

Expanded Core File Names

If a global core file directory is enabled, core files can be distinguished from one another by using the variables described in the following table.

For example, if the global core file path is set to:

/var/core/core.%f.%p

and a sendmail process with PID 12345 terminates abnormally, it produces the following core file:

/var/core/core.sendmail.12345

Setting the Core File Name Pattern

You can set a core file name pattern on a global, zone, or per-process basis. In addition, you can set the per-process defaults that persist across a system reboot.

For example, the following coreadm command sets the default per-process core file pattern. This setting applies to all processes that have not explicitly overridden the default core file pattern. This setting persists across system reboots.

# coreadm -i /var/core/core.%f.%p

The following coreadm command sets the per-process core file name pattern for any processes:

$ coreadm -p /var/core/core.%f.%p $$

The $$ symbols represent a placeholder for the process ID of the currently running shell. The per-process core file name pattern is inherited by all child processes.

Once a global or per-process core file name pattern is set, it must be enabled with the coreadm -e command. See the following procedures for more information.

You can set the core file name pattern for all processes run during a user's login session by putting the command in a user's $HOME/.profile or .login file.

Enabling setuid Programs to Produce Core Files

You can use the coreadm command to enable or disable setuid programs to produce core files for all system processes or on a per-process basis by setting the following paths:

• If the global setuid option is enabled, a global core file path allows all setuid programs on a system to produce core files.

• If the per-process setuid option is enable, a per-process core file path allows specific setuid processes to produce core files.

By default, both flags are disabled. For security reasons, the global core file path must be a full pathname, starting with a leading /. If superuser disables per-process core files, individual users cannot obtain core files.

The setuid core files are owned by superuser with read/write permissions for superuser only. Regular users cannot access them even if the process that produced the setuid core file was owned by an ordinary user.

For more information, see the coreadm(1M) man page.

How to Display the Current Core Dump Configuration

Use the coreadm command without any options to display the current core dump configuration.

$ coreadm
               global core file pattern: 
     global core file content: default
       init core file pattern: core
       init core file content: default
            global core dumps: disabled
       per-process core dumps: enabled
      global setid core dumps: disabled
 per-process setid core dumps: disabled
     global core dump logging: disabled

How to Set a Core File Name Pattern

1. Determine whether you want to set a per-process or global core file and select one of the following:

   1. Set a per-process file name pattern.

      $ coreadm -p $HOME/corefiles/%f.%p $$

   2. Become superuser or assume an equivalent role.

      Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

   3. Set a global file name pattern.

      # coreadm -g /var/corefiles/%f.%p

How to Enable a Per-Process Core File Path

1. Become superuser or assume an equivalent role.

   Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Enable a per-process core file path.

   # coreadm -e process

3. Display the current process core file path to verify the configuration.

   $ coreadm $$ 1180: /home/kryten/corefiles/%f.%p

How to Enable a Global Core File Path

1. Become superuser or assume an equivalent role.

   Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Enable a global core file path.

   # coreadm -e global -g /var/core/core.%f.%p

3. Display the current process core file path to verify the configuration.

   # coreadm global core file pattern: /var/core/core.%f.%p global core file content: default init core file pattern: core init core file content: default global core dumps: enabled per-process core dumps: enabled global setid core dumps: disabled per-process setid core dumps: disabled global core dump logging: disabled

Troubleshooting Core File Problems

Error Message

NOTICE: 'set allow_setid_core = 1' in /etc/system is obsolete NOTICE: Use the coreadm command instead of 'allow_setid_core'

Cause

You have an obsolete parameter that allows setuid core files in your /etc/system file.

Solution

Remove allow_setid_core=1 from the /etc/system file. Then use the coreadm command to enable global setuid core file paths.

Examining Core Files

Some of the proc tools have been enhanced to examine process core files as well as live processes. The proc tools are utilities that can manipulate features of the /proc file system.

The /usr/proc/bin/pstack, pmap, pldd, pflags, and pcred tools can now be applied to core files by specifying the name of the core file on the command line, similar to the way you specify a process ID to these commands.

For more information on using proc tools to examine core files, see proc(1).

Example 16–1 Examining Core Files With proc Tools

$ ./a.out
Segmentation Fault(coredump)
$ /usr/proc/bin/pstack ./core
core './core' of 19305: ./a.out
 000108c4 main     (1, ffbef5cc, ffbef5d4, 20800, 0, 0) + 1c
 00010880 _start   (0, 0, 0, 0, 0, 0) + b8