Find which program caused a core dump file

问题

I've been going through intense program/package installation recently, so I can't tell for sure which of the newly installed programs (or old programs) caused the appearance of a core file in my home folder. It's a server, so I better find out any possible sources of instability on the machine.

回答1:

You can simply use the file program to identify them:

E.g

# file /var/core/core
/var/core/core:     ELF 64-bit MSB core file SPARCV9 Version 1, from 'crs_stat.bin'

回答2:

Often using the file program on the core file will show the errant executable, as explained by @Benj in the accepted answer (code from Benj's answer):

# file /var/core/core
/var/core/core:     ELF 64-bit MSB core file SPARCV9 Version 1, from 'crs_stat.bin'

However, sometimes you may get a complaint about "too many program header sections":

core.some-lib.nnnn.nnnn: ELF 64-bit LSB  core file x86-64, version 1 (SYSV), too many program header sections (1850)

In this case, you can try some alternatives:

• Tail the last several strings of the corefile (the app was about 25 back for me): strings core.some-lib.nnnn.nnnn | tail -50
• Use gdb itself: gdb -c core.some-lib.nnnn.nnnn This will often tell you something like this: Core was generated by '/usr/local/bin/some-executable'

回答3:

you can navigate to the directory where the core.pid is and run gdb core core.pid

来源：https://stackoverflow.com/questions/13308922/find-which-program-caused-a-core-dump-file