0

I'm currently working on a weird GNU chroot environment, that uses abrt-hook-ccpp for the original system to dump cores, however the environment I'm in does not have that utility.

systemd-coredump does not exist on the chrooted environment either, so it is not an option.

I would like to access a core file. I can drop out of chroot and remotely copy it somewhere else for analysis, and I need little to no information as I know when and where the core is being created.

What's the simplest, most basic core-pattern file I can create to dump the core into the current (or any) directory?

Improve this question
0

2 Answers 2

Reset to default
1

Literally just core. Anything that is not prefixed by | is used as a file name (absolute within the chroot, or relative to the working directory). See core(5) for more details.

Note that when dumps are written directly to a file (not piped), the RLIMIT_CORE ulimit of the crashing process will be enforced – if it's zero, no core file will be created.

You can also create a custom handler script for |-format patterns (e.g. you could make "abrt-hook-ccpp" a regular bash script that runs cat > /tmp/core); the handler only needs to read the dump from its stdin and save it somewhere. In this case, RLIMIT_CORE is not enforced.

Improve this answer
3
  • This is perfect - looks like I'll still have to build core from source, but it gets me somewhere easier
    – Brydon Gibson
    Commented Oct 4, 2022 at 16:46
  • Build what from source? There's no program named "core" involved here. The string "core" is the actual name of your core-dump file.
    – grawity_u1686
    Commented Oct 4, 2022 at 16:48
  • I misunderstood the man entry - I had assumed core was a program.
    – Brydon Gibson
    Commented Oct 4, 2022 at 16:49
0

If your system is configured to send the core to the abrt (Automated Bug Reporting Tool), you may find it in /var/cache/abrt. Check also /var/crash.

Reference : Core dumped, but core file is not in the current directory?

Improve this answer
1
  • /system is bind-linked to the running kernel, which uses abrt, but the chrooted environment does not have abrt, so the core is never being created. The problem is not finding where abrt puts the core, it's finding an alternative that I can be certain will work on the barebones chrooted system
    – Brydon Gibson
    Commented Oct 4, 2022 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .