<< Back to article

coredumpctl

When a process crashes due to an unhandled signal (e.g., segmentation fault, abort), the kernel can write its memory image to disk as a core dump. Core dumps are invaluable for debugging crashes, as they capture the complete state of the process at the moment of failure.

Core Dumps

A core dump (or crash dump) is a file containing the memory image of a crashed process, along with register values, signal information, and other metadata. Debuggers use core dumps to perform post-mortem analysis—examining the program state after it has terminated.

Core dumps are generated when a process receives certain signals:

  • SIGSEGV: Segmentation fault (invalid memory access).
  • SIGABRT: Abort signal (e.g., from abort).
  • SIGILL: Illegal instruction.
  • SIGBUS: Bus error.
  • SIGFPE: Floating-point exception.

coredumpctl

Systemd provides coredumpctl to manage core dumps. It stores core dumps in a journal and provides tools for inspection and extraction.

Listing Core Dumps

coredumpctl list              # List all core dumps
coredumpctl list nginx        # List core dumps for nginx
coredumpctl list --since yesterday

Inspecting a Core Dump

coredumpctl info nginx        # Show metadata
coredumpctl info 1234         # By PID
coredumpctl info /var/lib/systemd/coredump/core.nginx.1000.abc123.dmp

Extracting a Core Dump

coredumpctl dump nginx -o /tmp/nginx.core

Debugging with GDB

Extract the core dump and the corresponding binary, then load both into gdb:

coredumpctl dump nginx -o /tmp/core
cp /usr/sbin/nginx /tmp/nginx.bin
gdb /tmp/nginx.bin /tmp/core
(gdb) bt                      # Show backtrace
(gdb) info registers          # Show register state
(gdb) list                    # Show source around current location
(gdb) quit

Configuration

Core dump storage is configured in /etc/systemd/coredump.conf:

[Coredump]
Storage=external
Compress=yes
ProcessSizeMax=2G
  • Storage=external: Store dumps in /var/lib/systemd/coredump/.
  • Storage=journal: Store dumps in the journal.
  • Storage=none: Disable core dumps.

/proc/sys/kernel/core_pattern

The kernel's core dump naming pattern is controlled by /proc/sys/kernel/core_pattern:

cat /proc/sys/kernel/core_pattern

If this starts with |, the kernel pipes the core dump to an external program (e.g., Apport, systemd-coredump).