Find which program caused a core dump file

Question

I\'ve been going through intense program/package installation recently, so I can\'t tell for sure which of the newly installed programs (or old programs) caused the appearance o

Answer 1

Often using the file program on the core file will show the errant executable, as explained by @Benj in the accepted answer (code from Benj's answer):

# file /var/core/core
/var/core/core:     ELF 64-bit MSB core file SPARCV9 Version 1, from 'crs_stat.bin'

However, sometimes you may get a complaint about "too many program header sections":

core.some-lib.nnnn.nnnn: ELF 64-bit LSB  core file x86-64, version 1 (SYSV), too many program header sections (1850)

In this case, you can try some alternatives:

• Tail the last several strings of the corefile (the app was about 25 back for me): strings core.some-lib.nnnn.nnnn | tail -50
• Use gdb itself: gdb -c core.some-lib.nnnn.nnnn This will often tell you something like this: Core was generated by '/usr/local/bin/some-executable'

Answer 2

You can simply use the file program to identify them:

E.g

# file /var/core/core
/var/core/core:     ELF 64-bit MSB core file SPARCV9 Version 1, from 'crs_stat.bin'

Answer 3

you can navigate to the directory where the core.pid is and run gdb core core.pid