Comprehensive Guide to Core Dump File Locations and Configuration in Linux Systems

Core Dump Mechanism Overview

In Linux systems, when a program encounters a critical error (such as a segmentation fault), the system generates a core dump file containing the program's memory state at the time of crash. This file is essential for debugging and analyzing program failures. However, many developers encounter situations where the system indicates "(core dumped)" but the expected core file is missing from the current working directory.

Determinants of Core Dump File Location

The storage location of core dump files is primarily controlled by the /proc/sys/kernel/core_pattern configuration file. This file defines the naming pattern and storage location for core dumps. The current system configuration can be examined using:

cat /proc/sys/kernel/core_pattern

If the file content begins with a pipe symbol |, it indicates that core dumps are redirected to a specified program for processing rather than being written directly to disk. For example:

|/usr/lib/systemd/systemd-coredump %p %u %g %s %t %e

Modern Core Dump Handling Systems

ABRT System

In Red Hat-based Linux distributions, the Automated Bug Reporting Tool (ABRT) handles core dump processing. When core_pattern is configured to route through ABRT, core dump files are typically stored in the /var/cache/abrt directory. ABRT automatically collects crash information and generates detailed error reports.

Apport System

Ubuntu systems utilize Apport as their crash reporting system. When a program crashes, Apport intercepts the core dump and determines the appropriate handling based on program type. For installed packages, Apport generates comprehensive crash reports; for locally compiled programs, additional configuration may be required:

# Create Apport configuration file
echo "[main]" > ~/.config/apport/settings
echo "unpackaged=true" >> ~/.config/apport/settings

After configuration, core dump files will be stored in the /var/crash directory with filename patterns like *.1000.crash.

systemd-coredump System

Modern Linux distributions using systemd typically configure core_pattern to send core dumps to the systemd-coredump service. Core dumps are stored in the system journal and can be examined using:

coredumpctl list
coredumpctl info <PID>

To modify storage locations, edit the /etc/systemd/coredump.conf file:

# Set core dump storage to external files
[Storage]
Storage=external

Core Dump Configuration and Debugging

Basic Configuration Verification

First, ensure core dump functionality is enabled:

# Set unlimited core dump file size
ulimit -c unlimited

# Verify the setting
ulimit -a

Custom Core Dump Location

To restore traditional current directory storage for core dumps, modify core_pattern:

# Temporary modification
echo core | sudo tee /proc/sys/kernel/core_pattern

# Permanent modification (add to /etc/sysctl.conf)
echo "kernel.core_pattern=core" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Debugging Example

Consider the following C program that generates a segmentation fault:

#include <stdio.h>
#include <stdlib.h>

void cause_segfault() {
    int *ptr = NULL;
    *ptr = 42;  // Dereferencing null pointer causes segmentation fault
}

int main() {
    printf("Program starting...\n");
    cause_segfault();
    printf("This line will not execute\n");
    return 0;
}

Compile and run the program:

gcc -g -o segfault segfault.c
./segfault

Depending on system configuration, the core dump file may appear in different locations, requiring appropriate tools for localization and analysis.

Core Dump File Analysis

Once the core dump file is located, use GDB for in-depth analysis:

# For traditional core files
gdb ./program core

# For Apport-generated crash reports
apport-unpack /var/crash/report.crash /tmp/core_analysis
gdb ./program /tmp/core_analysis/CoreDump

# For systemd-managed core dumps
coredumpctl gdb <PID>

Best Practices Recommendations

In development environments, it's recommended to configure core dumps for direct writing to the current directory to facilitate rapid debugging:

# Development environment setup
echo "kernel.core_pattern=core.%p.%t" | sudo tee /proc/sys/kernel/core_pattern

This configuration generates core files in the current directory with process ID and timestamp information, preventing file overwriting issues.

Conclusion

The Linux core dump mechanism provides powerful capabilities for program crash analysis, but modern automated handling tools have altered traditional file storage approaches. Understanding core_pattern configuration and the operational principles of various core dump handling systems is crucial for effectively utilizing core dumps in program debugging. Through proper configuration and tool usage, developers can fully leverage core dump information to identify and resolve critical program errors.