Linux 查找导致核心转储文件的程序
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/13308922/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Find which program caused a core dump file
提问by Desmond Hume
I've been going through intense program/package installation recently, so I can't tell for sure which of the newly installed programs (or old programs) caused the appearance of a corefile in my home folder. It's a server, so I better find out any possible sources of instability on the machine.
我最近一直在进行大量的程序/包安装，所以我无法确定是哪些新安装的程序（或旧程序）导致了core我的主文件夹中出现文件。这是一个服务器，所以我最好找出机器上任何可能的不稳定来源。
采纳答案by Benj
You can simply use the fileprogram to identify them:
您可以简单地使用该file程序来识别它们：
E.g
例如
# file /var/core/core
/var/core/core: ELF 64-bit MSB core file SPARCV9 Version 1, from 'crs_stat.bin'
回答by SuperChekkan
you can navigate to the directory where the core.pid is and run gdb core core.pid
您可以导航到 core.pid 所在的目录并运行 gdb core core.pid
回答by rholmes
Often using the file program on the core file will show the errant executable, as explained by @Benj in the accepted answer (code from Benj's answer):
通常在核心文件上使用文件程序会显示错误的可执行文件，正如@Benj 在接受的答案中所解释的（来自 Benj 答案的代码）：
# file /var/core/core
/var/core/core: ELF 64-bit MSB core file SPARCV9 Version 1, from 'crs_stat.bin'
However, sometimes you may get a complaint about "too many program header sections":
但是，有时您可能会抱怨“程序头部分太多”：
core.some-lib.nnnn.nnnn: ELF 64-bit LSB core file x86-64, version 1 (SYSV), too many program header sections (1850)
In this case, you can try some alternatives:
在这种情况下，您可以尝试一些替代方案：
- Tail the last several strings of the corefile (the app was about 25 back for me):
strings core.some-lib.nnnn.nnnn | tail -50 - Use gdb itself:
gdb -c core.some-lib.nnnn.nnnnThis will often tell you something like this:Core was generated by '/usr/local/bin/some-executable'
- 尾核心文件的最后几个字符串（该应用程序对我来说大约是 25 回）：
strings core.some-lib.nnnn.nnnn | tail -50 - 使用 gdb 本身：
gdb -c core.some-lib.nnnn.nnnn这通常会告诉你这样的事情：Core was generated by '/usr/local/bin/some-executable'
