10.19 How to Produce a Core File from Your Program

A core file or core dump is a file that records the memory image of a running process and its process status (register values etc.). Its primary use is post-mortem debugging of a program that crashed while it ran outside a debugger. A program that crashes automatically produces a core file, unless this feature is disabled by the user. See Files, for information on invoking gdb in the post-mortem debugging mode.

Occasionally, you may wish to produce a core file of the program you are debugging in order to preserve a snapshot of its state. gdb has a special command for that.

generate-core-file [file]

gcore [file]

Produce a core dump of the inferior process. The optional argument file specifies the file name where to put the core dump. If not specified, the file name defaults to core.pid, where pid is the inferior process ID.

Note that this command is implemented only for some systems (as of this writing, gnu/Linux, FreeBSD, Solaris, and S390).

On gnu/Linux, this command can take into account the value of the file /proc/pid/coredump_filter when generating the core dump (see set use-coredump-filter).

set use-coredump-filter on

set use-coredump-filter off

Enable or disable the use of the file /proc/pid/coredump_filter when generating core dump files. This file is used by the Linux kernel to decide what types of memory mappings will be dumped or ignored when generating a core dump file. pid is the process ID of a currently running process.

To make use of this feature, you have to write in the /proc/pid/coredump_filter file a value, in hexadecimal, which is a bit mask representing the memory mapping types. If a bit is set in the bit mask, then the memory mappings of the corresponding types will be dumped; otherwise, they will be ignored. This configuration is inherited by child processes. For more information about the bits that can be set in the /proc/pid/coredump_filter file, please refer to the manpage of core(5).

By default, this option is on. If this option is turned off, gdb does not read the coredump_filter file and instead uses the same default value as the Linux kernel in order to decide which pages will be dumped in the core dump file. This value is currently 0x33, which means that bits 0 (anonymous private mappings), 1 (anonymous shared mappings), 4 (ELF headers) and 5 (private huge pages) are active. This will cause these memory mappings to be dumped automatically.