What is a core dump in Unix?

Answer 1

While I'm not familiar with any Unix OS that creates files named core.dmp (Unix systems do not typically use 3 letter suffixes), I can speak to the file commonly called just "core". This file gets created when an application performs an illegal activity, such as referencing an address outside its address space or dividing by zero. Illegal activities result in a synchronous signal being sent to the offending process. Unless handled, the typical result is for an image of the process to be saved to the file called "core". Tools such as "gdb" or "adb" can be used to examine the core file in order to determine what the process was doing that caused it to receive the signal. However, unless the process was compiled with debug information (e.g., -g) and linked with symbols intact, there's precious little that can be deduced. If the process has no symbols nor debug information, the simplest thing to do is to use the "file" command: file core in order to view an abbreviated description (name of the process and the signal that terminated the process). For more information, see the signal(2) and signal(5) man pages on any decent Unix system. (p.s. I speak from 25 years as a Unix developer.)

AnswerCORE DUMP are images of application failure messages during there execution in LINUX/UNIX they give little clue about what happened to that particular application while run. Cause of application failure may be anything e.g. memory violation ,not enough memory or anything that makes an application to stop run. For further refrences please refer to the System Administration Handbook on LINUX that comes from different writers but one that I have read is by Nemeith . Any even I can suggest you more at rupesh_joshi@sify.com rupesh.joshi@gmail.com Rupesh Kumar Joshi India Answer

This response is anecdotal but may also be informative. In the early 1990s we operated a 3 processor Unix server which one day had what is known as a kernel panic. When a Unix kernel panics, it attempts to write out a core dump containing the state of the CPU registers and memory at the time of the panic. Typically, the Unix or Linux crash utility or program is then used on the core dump to help in determining the cause of the panic.

Unfortunately, since we discovered that our server was experiencing a second kernel panic while in the process of writing it's core dump from it's first kernel panic, the core dump failed and was not properly written out to disk thus using the crash utility was not possible. Eventually, the problem was identified as a failed CPU and, after replacing the failed CPU, all kernel panics stopped and the server ran normally. Had our kernel not panicked while experiencing a kernel panic, we would have been able to use the core dump to determine the cause of the kernel panic by using the crashprogram to analyze the core dump.