Where Are Core Files Stored in a Lxc Container

Where are core files stored in a lxc container?

| indicates that a program should handle the core dump. Rather than saving the coredump to a file it will be piped into that programs input. Means if core_pattern is set to |... apport apport will handle the core dumps.

Unfortunately apport will create coredumps only for installed packages. I would set the pattern to a file name, like this:

echo '/tmp/cores/core.%e.%p.%t' > /proc/sys/kernel/core_pattern

The would give you coredumps like /tmp/core.program.pid.012345678 where program is the program name, pid the program's pid plus a timestamp at the end.

Check man core for more information (espcecially information about meta chars that can be used in the core pattern.

What is the core file in Docker and can I remove it?

In general core files are generated when a program crashes/stops abnormally. It contains information about the program at he moment of crash such as data, stack traces, registers etc. One can use this for debugging the program. You can limit the size of the core file generated by using following

docker run --ulimit core=size

Follow the documentation on using ulimit flag

You can perform some cleanup using following. This will not remove your active volume and containers.

docker volume rm $(docker volume ls -qf dangling=true)

Core dumped, but core file is not in the current directory?

Read /usr/src/linux/Documentation/sysctl/kernel.txt.

core_pattern is used to specify a core dumpfile pattern name.

• If the first character of the pattern is a '|', the kernel will treat
  the rest of the pattern as a command to run. The core dump will be
  written to the standard input of that program instead of to a file.

Instead of writing the core dump to disk, your system is configured to send it to the abrt (meaning: Automated Bug Reporting Tool, not "abort") program instead. Automated Bug Reporting Tool is possibly not as documented as it should be...

In any case, the quick answer is that you should be able to find your core file in /var/cache/abrt, where abrt stores it after being invoked. Similarly, other systems using Apport may squirrel away cores in /var/crash, and so on.

How to generate coredump file in alpine container

I finally found the solution:

docker run -it --rm --ulimit core=-1  --privileged -v $PWD:/coredump <myimage> bash

In container, set core pattern and run app:

sysctl -w kernel.core_pattern=/coredump/core-%e.%p.%h.%t
app # coredumped to /coredump/ directory

Since we mount $PWD to /coredump, so we can see core file in current directory.

Find Core File in multiple machine

The old-fashioned way is to periodically search the whole filesystem for core files:

find / -type f -name core

or

find / -type f -name 'core.*'

This, naturally, does have the risk of matching user files with the (rather unfortunate) name core.

Fortunately, modern Linux systems are somewhat more configurable. You can use the /proc/sys/kernel/core_pattern file to set up a specific directory where core files will be placed, as well as a format for the name of the file. You can have core filenames that contain the name of the program, the UID and GID under which it was launched and so on - have a look at this manual page.

This way you can keep all your core files in a single directory, which has several advantages:

• You do not risk having core files sprinkled all over the filesystem.

• You can easily remove all core files without the computational expense of searching all over the filesystem and without the risk of removing user files.

• Since all core files are in a single place, it is far more reasonable to poll for new files as needed.

• If you want immediate action, you can avoid polling by using inotifywait or other tools based on inotify to monitor the core file directory.

---

Related Topics