A small number of signals which cause abnormal termination of a process
also cause a record of the process's in-core state to be written
to disk for later examination by one of the available debuggers.
(See
sigaction(2).)
This memory image is written to a file named by default
programname.core
in the working directory;
provided the terminated process had write permission in the directory,
and provided the abnormality did not cause
a system crash.
(In this event, the decision to save the core file is arbitrary, see
savecore(8).)
The maximum size of a core file is limited by
setrlimit(2).
Files which would be larger than the limit are not created.
The name of the file is controlled via the
sysctl(8)
variable
kern.corefile
The contents of this variable describes a filename to store
the core image to.
This filename can be absolute, or relative (which
will resolve to the current working directory of the program
generating it).
Any sequence of
%N
in this filename template will be replaced by the process name,
%P
by the processes PID, and
%U
by the UID.
The name defaults to
%N.core
yielding the traditional
Fx behaviour.
By default, a process that changes user or group credentials whether
real or effective will not create a corefile.
This behaviour can be
changed to generate a core dump by setting the
sysctl(8)
variable
kern.sugid_coredump
to 1.
EXAMPLES
In order to store all core images in per-user private areas under
/var/coredumps
the following
sysctl(8)
command can be used:
