How to get core dump from stopped program (linux)
I have a program, which was stopped by kill -STOP
. I want to take a core dump of it without running it (program must be stopped for all time; if it will receive a SIGCONT, it will die without coredump). How can I get a coredump?
Is it possible to keep program in its current state after taking a coredump? It is a very rare situation, and I can't reproduce it, but I must to analyze it.
Thanks
UPDATES: gcore doesn't work. Gdb (even root) can't attach to stopped process (waits forever on ptrace PTRACE_ATTACH). Even dd can't read from /proc/99999/mem with good offsets from /proc/99999/maps (error is No such process
).
If I try to attach gdb to process and send a SIGCONT to stopped process, I got
path... linux-nat.c:####: internal-error: linux_nat_attach: Assertion `pid == GET_PID (inferior_ptid) && WIFSTOPPED (status) && WSTOPSIG (status) == SIGSTOP' failed.
A problem internal to GDB has been detected,
further debugging may prove unreliable.
A problem internal to GDB has been detected,
further debugging may prove unreliable.
If i go to the gdb and sa开发者_运维百科ve a core, it will be corrupted. "Failed to read a valid object file image from memory."
Attach to the current process with gdb
and issue the generate-core-file
command.
Or you can run gcore
and supply the process id as a parameter.
Send the process an ABRT signal while it is stopped, then restart it with CONT. It will dump core and abort.
If restarting the process it is not an option for some reason, you can try to examine the pseudofile /proc/[pid]/mem, but it is not in core format, so it is less useable.
精彩评论