Basically, you use a debugger. Since you did not specify an OS I'll assume you have
gdb. You must have compiled the file
in order for symbols to be available. If you are analyzing a core dump of somebody else's code you are in trouble.
The core dump file is called core
This will show you a backtrace (stack dump) of the call tree that lead to the crash.
You will have to find using the stack dump where in the code (not in a C library) the crash occurred. In other words the last line of the program's code that actually led to the crash.
Hi folks,
I'm hoping someone would be charitable enough to give me a quick explanation of adb usage for analyzing core files...or point me in the right direction. A search here revealed scant results and web searches are providing me with ambiguous information.
Running Solaris.
Thanks,... (1 Reply)
Hi,
I just wanted to know is there any tool avaliable for core analysis on hp-ux. I have heard about q4 utility. But I think it is used for analysis of system crash dump and not for core dump produced by a user process.
gdb doesn't give much information unless the binary is debug-build.
... (0 Replies)
Hello,
I'm new to the group and this is my first post. I'm hoping someone can help me out. I have a core dump that I need to analyze from a Unix box and I've never done this sort of thing before. I was told to run a pmap and pstack on the core file which provided two different output files. ... (3 Replies)
How can we analyze a core file and determine why it was generated on a solaris system?
I know file core filename will tell us what program generated the file. But, what to do next to get more details?
Thanks, (5 Replies)
We have just enabled core dump on our RHEL5.7 OS. the java process is terminating very often so we enable core dump to analysis the issue and find below in core dump file.
Core was generated by `/usr/java/jdk1.6.0_06//bin/java -server -Xms1536m -Xmx1536m -Xmn576m -XX:+Aggre'.
Program... (0 Replies)
dear all,
i have p770 aix6.1
last week, the host reboot suddenly with dump. but i don't know how to analyze the dump.
I posted kdb details in the attachment.
please anybody help me.
#>kdb vmcore.0 /unix
vmcore.0 mapped from @ 700000000000000 to @ 7000001c72c0908
START ... (13 Replies)
Discussion started by: tomato00
13 Replies
LEARN ABOUT BSD
savecore
SAVECORE(8) System Manager's Manual SAVECORE(8)NAME
savecore - save a core dump of the operating system
SYNOPSIS
savecore dirname [ system ]
DESCRIPTION
Savecore is meant to be called at the end of the /etc/rc file. Its function is to save the core dump of the system (if one was made) and
to write a reboot message in the shutdown log.
It saves the core image in the file dirname/core.n and its corresponding namelist in dirname/unix.n. The second argument is the namelist
for the system which made the core image; the current system is always assumed to be /unix. The trailing ".n" in the pathnames is replaced
by a number which grows every time savecore is run in that directory.
Before savecore writes out a core image, it reads a number from the file dirname/minfree. If there are fewer free blocks on the file sys-
tem which contains dirname than the number obtained from the minfree file, the core dump is not done. If the minfree file does not exist,
savecore always writes out the core file (assuming that a core dump was taken).
Savecore also writes a reboot message in the shut down log. If the system crashed as a result of a panic, savecore records the panic
string in the shut down log too.
If savecore detects that the system time is wrong because of a crash (the time in the core image is after the current time), it will reset
the system time to its best estimate of the time, which is the time in the core image plus the elapsed time since the reboot. It announces
the time that it set when this occurs.
FILES
/usr/adm/shutdownlogshutdown log
/unix current UNIX
BUGS
The method used to determine whether a dump is present, and to prevent the same core image from being saved multiple times, is not elegant.
This information should be passed to init by the system; however, this is difficult because the system may have to be rebooted a second
time if the root filesystem is patched.
3rd Berkeley DistributionSAVECORE(8)