CORE(5)

NAME
core - memory image file format

SYNOPSIS
#include <sys/param.h>

DESCRIPTION
A small number of signals which cause abnormal termination of a process also cause a record of the process's in-core state to be written to disk for later examination by one of the available debuggers. (See sigaction(2).) This memory image is written to a file named by default programname.core in the working directory; provided the terminated process had write permission in the directory, and provided the abnormality did not cause a system crash. (In this event, the decision to save the core file is arbitrary, see savecore(8).)

The maximum size of a core file is limited by setrlimit(2). Files which would be larger than the limit are not created.

The name of the file is controlled via the sysctl(8) variable kern.corefile. The contents of this variable describes a filename to store the core image to. This filename can be absolute, or relative (which will resolve to the current working directory of the program generating it).

The following format specifiers may be used in the kern.corefile sysctl to insert additional information into the resulting core file name:
%H  Machine hostname.
%I  An index starting at zero until the sysctl debug.ncores is reached. This can be useful for limiting the number of corefiles generated by a particular process.
%N  process name.
%P  processes PID.
%U  process UID.

The name defaults to %N.core, yielding the traditional FreeBSD behaviour.

By default, a process that changes user or group credentials whether real or effective will not create a corefile. This behaviour can be changed to generate a core dump by setting the sysctl(8) variable kern.sugid_coredump to 1.

Corefiles can be compressed by the kernel if the following items are included in the kernel configuration file:
options
    COMPRESS_USER_CORES
devices
    gzio

When COMPRESS_USER_CORES is included the following sysctls can control if core files will be compressed:
kern.compress_user_cores_gzlevel
    Gzip compression level. Defaults to -1.
kern.compress_user_cores
    Actually compress user cores. Core files will have the suffix .gz appended to them.

EXAMPLES
In order to store all core images in per-user private areas under /var/coredumps, the following sysctl(8) command can be used:

    sysctl kern.corefile=/var/coredumps/%U/%N.core

SEE ALSO
gdb(1), kgdb(1), setrlimit(2), sigaction(2), sysctl(8)

HISTORY
A core file format appeared in AT&T UNIX.