# Core dump

## Making a Core Dump

You can easily generate a core dump of any process. First install gdb:

    $ pacman -Syu gdb

Find the PID of the running process. You might use top or htop or `pstree` (psmisc) or `ps` (procps-ng). For example, to find the PID of firefox:

    $ ps -o pid= -o args= -C firefox
    2071 firefox

Attach to the process:

    $ gdb -p 2071

Then at the `(gdb)` prompt, type this:

    (gdb) generate-core-file
    Saved corefile core.2071
    (gdb) quit

Now you have a coredump file called `core.2071`.

## Always dump core by default

Global settings are in `/etc/security/limits.conf`.

Bash settings are in `ulimit -c`.

### Where do they go?

The `kernel.core_pattern` sysctl decides where automatic core dumps go:

    $ cat /proc/sys/kernel/core_pattern
    |/usr/lib/systemd/systemd-coredump %p %u %g %s %t %e

The default set in `/usr/lib/sysctl.d/50-coredump.conf` sends all core dumps to journald as part of the system logs.

Note: If you don't have full-disk encryption, this means your program's memory will be written to raw disk! This is a potential information leak even if you have encrypted swap.

To retreive a coredump from the journal, see `man systemd-coredumpctl`

## What do I do with them?

todo

Category:

- Development