1.\" Copyright (c) 1980, 1991, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.Dd November 12, 2023 29.Dt CORE 5 30.Os 31.Sh NAME 32.Nm core 33.Nd memory image file format 34.Sh SYNOPSIS 35.In sys/param.h 36.Sh DESCRIPTION 37A small number of signals which cause abnormal termination of a process 38also cause a record of the process's in-core state to be written 39to disk for later examination by one of the available debuggers. 40(See 41.Xr sigaction 2 . ) 42This memory image is written to a file named by default 43.Nm programname.core 44in the working directory; 45provided the terminated process had write permission in the directory, 46and provided the abnormality did not cause 47a system crash. 48(In this event, the decision to save the core file is arbitrary, see 49.Xr savecore 8 . ) 50.Pp 51The maximum size of a core file is limited by the 52.Dv RLIMIT_CORE 53.Xr setrlimit 2 54limit. 55Files which would be larger than the limit are not created. 56.Pp 57With a large limit, a process that had mapped a very large, 58and perhaps sparsely populated, virtual memory region, could take 59a very long time to create core dumps. 60The system ignores all signals sent to a process writing a core file, except 61.Dv SIGKILL 62which terminates the writing and causes immediate exit of the process. 63The behavior of 64.Dv SIGKILL 65can be disabled by setting tunable 66.Xr sysctl 8 67variable 68.Va kern.core_dump_can_intr 69to zero. 70.Pp 71The name of the file is controlled via the 72.Xr sysctl 8 73variable 74.Va kern.corefile . 75The contents of this variable describes a filename to store 76the core image to. 77This filename can be absolute, or relative (which 78will resolve to the current working directory of the program 79generating it). 80.Pp 81The following format specifiers may be used in the 82.Va kern.corefile 83sysctl to insert additional information into the resulting core 84filename: 85.Bl -tag -width "1234567890" -compact -offset "12345" 86.It Em \&%H 87Machine hostname. 88.It Em \&%I 89An index starting at zero until the sysctl 90.Em debug.ncores 91is reached. 92This can be useful for limiting the number of corefiles 93generated by a particular process. 94.It Em \&%N 95process name. 96.It Em \&%P 97processes PID. 98.It Em \&%S 99signal during core. 100.It Em \&%U 101process UID. 102.El 103.Pp 104The name defaults to 105.Em \&%N.core , 106yielding the traditional 107.Fx 108behaviour. 109.Pp 110By default, a process that changes user or group credentials whether 111real or effective will not create a corefile. 112This behaviour can be 113changed to generate a core dump by setting the 114.Xr sysctl 8 115variable 116.Va kern.sugid_coredump 117to 1. 118.Pp 119Corefiles can be compressed by the kernel if the following item 120is included in the kernel configuration file: 121.Bl -tag -width "1234567890" -compact -offset "12345" 122.It options 123GZIO 124.El 125.Pp 126The following sysctl control core file compression: 127.Bl -tag -width "kern.compress_user_cores_level" -compact -offset "12345" 128.It Em kern.compress_user_cores 129Enable compression of user cores. 130A value of 1 configures 131.Xr gzip 1 132compression, 133and a value of 2 configures 134.Xr zstd 1 135compression. 136Compressed core files will have a suffix of 137.Ql .gz 138or 139.Ql .zst 140appended to their filenames depending on the selected format. 141.It Em kern.compress_user_cores_level 142Compression level. 143Defaults to 6. 144.El 145.Sh NOTES 146Corefiles are written with open file descriptor information as an ELF note. 147By default, file paths are packed to only use as much space as needed. 148However, file paths can change at any time, including during core dump, 149and this can result in truncated file descriptor data. 150.Pp 151All file descriptor information can be preserved by disabling packing. 152This potentially wastes up to PATH_MAX bytes per open fd. 153Packing is disabled with 154.Dl sysctl kern.coredump_pack_fileinfo=0 . 155.Pp 156Similarly, corefiles are written with vmmap information as an ELF note, which 157contains file paths. 158By default, they are packed to only use as much space as 159needed. 160By the same mechanism as for the open files note, these paths can also 161change at any time and result in a truncated note. 162.Pp 163All vmmap information can be preserved by disabling packing. 164Like the file information, this potentially wastes up to PATH_MAX bytes per 165mapped object. 166Packing is disabled with 167.Dl sysctl kern.coredump_pack_vmmapinfo=0 . 168.Sh EXAMPLES 169In order to store all core images in per-user private areas under 170.Pa /var/coredumps 171(assuming the appropriate subdirectories exist and are writable by users), 172the following 173.Xr sysctl 8 174command can be used: 175.Pp 176.Dl sysctl kern.corefile=/var/coredumps/\&%U/\&%N.core 177.Sh SEE ALSO 178.Xr gdb 1 Pq Pa ports/devel/gdb , 179.Xr gzip 1 , 180.Xr kgdb 1 Pq Pa ports/devel/gdb , 181.Xr setrlimit 2 , 182.Xr sigaction 2 , 183.Xr sysctl 8 184.Sh HISTORY 185A 186.Nm 187file format appeared in 188.At v1 . 189