Selective Core Dump in Linux - How to Select the Dumped Sections

Selective core dump in Linux - How can I select the dumped sections?

According to the core(5) manpage, you can set which mappings are written to the core file:

Since kernel 2.6.23, the
Linux-specific
/proc/PID/coredump_filter file can be
used to control which memory segments
are written to the core dump file in
the event that a core dump is
performed for the process with the
corresponding process ID.

The value in the file is a bit mask of
memory mapping types (see mmap(2)).
If a bit is set in the mask, then
memory mappings of the corresponding
type are dumped; otherwise they are
not dumped. The bits in this file
have the following meanings:

       bit 0  Dump anonymous private mappings.
       bit 1  Dump anonymous shared mappings.
       bit 2  Dump file-backed private mappings.
       bit 3  Dump file-backed shared mappings.
       bit 4 (since Linux 2.6.24)
              Dump ELF headers.
       bit 5 (since Linux 2.6.28)
              Dump private huge pages.
       bit 6 (since Linux 2.6.28)
              Dump shared huge pages.

By default, the following bits are set: 0, 1, 4 (if the
CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS
kernel configuration option is enabled), and 5.
The value of this file is displayed in hexadecimal. (The
default value is thus displayed as 33.)
Memory-mapped I/O pages such as frame buffer are never dumped, and
virtual DSO pages are always dumped, regardless of the coredump_filter
value.

...

This file is only provided if the kernel was built with the
CONFIG_ELF_CORE configuration option.

Live Memory not matching Core Dumped Memory

Turned out to be RHEL4 and the Kernel it was running on, customer upgraded to RHEL5 with the latest Kernel and the problem vanished

Related Topics