core(5) [osx man page]

CORE(5) 						      BSD File Formats Manual							   CORE(5)

NAME

     core -- memory image file format

SYNOPSIS

     #include <sys/param.h>

DESCRIPTION

     A small number of signals which cause abnormal termination of a process also cause a record of the process's in-core state to be written to
     disk for later examination by one of the available debuggers.  (See sigaction(2).)  This memory image is written to a file named by default
     core.pid, where pid is the process ID of the process, in the /cores directory, provided the terminated process had write permission in the
     directory, and the directory existed.

     The maximum size of a core file is limited by setrlimit(2).  Files which would be larger than the limit are not created.

     The core file consists of the Mach-O(5) header as	described in the <mach-o/loader.h> file.  The remainder of the core file consists of vari-
     ous sections described in the Mach-O(5) header.

NOTE

     Core dumps are disabled by default under Darwin/Mac OS X.	To re-enable core dumps, a privileged user must do one of the following

     * Edit /etc/launchd.conf or $HOME/.launchd.conf and add a line specifying the limit limit core unlimited

     * A privileged user can also enable cores with launchctl limit core unlimited

     * A privileged user can also enable core files by using ulimit(1) or limit(1) depending upon the shell.

SEE ALSO

     gdb(1), setrlimit(2), sigaction(2), Mach-O(5), launchd.conf(5), launchd.plist(5), sysctl(8)

HISTORY

     A core file format appeared in Version 6 AT&T UNIX.

BSD
								   June 26, 2008							       BSD

gcore(1)						    BSD General Commands Manual 						  gcore(1)

NAME

     gcore -- get core images of running processes

SYNOPSIS

     gcore [-s] [-v] [-b size] [-o path | -c pathformat] pid

DESCRIPTION

     The gcore program creates a core file image of the process specified by pid.  The resulting core file can be used with a debugger, e.g.
     lldb(1), to examine the state of the process.

     The following options are available:

     -s 	 Suspend the process while the core file is captured.

     -v 	 Report progress on the dump as it proceeds.

     -b size	 Limit the size of the core file to size MiBytes.

     The following options control the name of the core file:

     -o path
	   Write the core file to path.

     -c pathformat
	   Write the core file to pathformat.  The pathformat string is treated as a pathname that may contain various special characters which
	   cause the interpolation of strings representing specific attributes of the process into the name.

	   Each special character is introduced by the % character.  The format characters and their meanings are:

	   N	       The name of the program being dumped, as reported by ps(1).

	   U	       The uid of the process being dumped, converted to a string.

	   P	       The pid of the process being dumped, converted to a string.

	   T	       The time when the core file was taken, converted to ISO 8601 format.

	   %	       Output a percent character.

     The default file name used by gcore is %N-%P-%T.  By default, the core file will be written to a directory whose name is determined from the
     kern.corefile MIB.  This can be printed or modified using sysctl(8).

     The directory where the core file is to be written must be accessible to the owner of the target process.

     gcore will not overwrite an existing file, nor will it create missing directories in the path.

EXIT_STATUS
     The gcore utility exits 0 on success, and >0 if an error occurs.

FILES

     /cores/%N-%P-%T	   default pathname for the corefile.

BUGS

     With the -b flag, gcore writes out as much data as it can up to the specified limit, even if that results in an incomplete core image.  Such
     a partial core dump may confuse subsequent programs that attempt to parse the contents of such files.

SEE ALSO

     lldb(1), core(5), Mach-O(5), sysctl(8), sudo(8).

Darwin								   May 31, 2019 							    Darwin