1COREDUMPCTL(1) coredumpctl COREDUMPCTL(1)
2
3
4
6 coredumpctl - Retrieve and process saved core dumps and metadata
7
9 coredumpctl [OPTIONS...] {COMMAND} [PID|COMM|EXE|MATCH...]
10
12 coredumpctl is a tool that can be used to retrieve and process core
13 dumps and metadata which were saved by systemd-coredump(8).
14
16 The following options are understood:
17
18 -h, --help
19 Print a short help text and exit.
20
21 --version
22 Print a short version string and exit.
23
24 --no-legend
25 Do not print column headers.
26
27 --no-pager
28 Do not pipe output into a pager.
29
30 -1
31 Show information of a single core dump only, instead of listing all
32 known core dumps.
33
34 -S, --since
35 Only print entries which are since the specified date.
36
37 -U, --until
38 Only print entries which are until the specified date.
39
40 -r, --reverse
41 Reverse output so that the newest entries are displayed first.
42
43 -F FIELD, --field=FIELD
44 Print all possible data values the specified field takes in
45 matching core dump entries of the journal.
46
47 -o FILE, --output=FILE
48 Write the core to FILE.
49
50 --debugger=DEBUGGER
51 Use the given debugger for the debug command. If not given and
52 $SYSTEMD_DEBUGGER is unset, then gdb(1) will be used.
53
54 -D DIR, --directory=DIR
55 Use the journal files in the specified DIR.
56
57 -q, --quiet
58 Suppresses informational messages about lack of access to journal
59 files and possible in-flight coredumps.
60
62 The following commands are understood:
63
64 list
65 List core dumps captured in the journal matching specified
66 characteristics. If no command is specified, this is the implied
67 default.
68
69 The output is designed to be human readable and contains list
70 contains a table with the following columns:
71
72 TIME
73 The timestamp of the crash, as reported by the kernel.
74
75 PID
76 The identifier of the process that crashed.
77
78 UID, GID
79 The user and group identifiers of the process that crashed.
80
81 SIGNAL
82 The signal that caused the process to crash, when applicable.
83
84 COREFILE
85 Information whether the coredump was stored, and whether it is
86 still accessible: "none" means the core was not stored, "-"
87 means that it was not available (for example because the
88 process was not terminated by a signal), "present" means that
89 the core file is accessible by the current user, "journal"
90 means that the core was stored in the "journal", "truncated" is
91 the same as one of the previous two, but the core was too large
92 and was not stored in its entirety, "error" means that the core
93 file cannot be accessed, most likely because of insufficient
94 permissions, and "missing" means that the core was stored in a
95 file, but this file has since been removed.
96
97 EXE
98 The full path to the executable. For backtraces of scripts this
99 is the name of the interpreter.
100
101 It's worth noting that different restrictions apply to data saved
102 in the journal and core dump files saved in
103 /var/lib/systemd/coredump, see overview in systemd-coredump(8).
104 Thus it may very well happen that a particular core dump is still
105 listed in the journal while its corresponding core dump file has
106 already been removed.
107
108 info
109 Show detailed information about core dumps captured in the journal.
110
111 dump
112 Extract the last core dump matching specified characteristics. The
113 core dump will be written on standard output, unless an output file
114 is specified with --output=.
115
116 debug
117 Invoke a debugger on the last core dump matching specified
118 characteristics. By default, gdb(1) will be used. This may be
119 changed using the --debugger= option or the $SYSTEMD_DEBUGGER
120 environment variable.
121
123 A match can be:
124
125 PID
126 Process ID of the process that dumped core. An integer.
127
128 COMM
129 Name of the executable (matches COREDUMP_COMM=). Must not contain
130 slashes.
131
132 EXE
133 Path to the executable (matches COREDUMP_EXE=). Must contain at
134 least one slash.
135
136 MATCH
137 General journalctl match filter, must contain an equals sign ("=").
138 See journalctl(1).
139
141 On success, 0 is returned; otherwise, a non-zero failure code is
142 returned. Not finding any matching core dumps is treated as failure.
143
145 $SYSTEMD_DEBUGGER
146 Use the given debugger for the debug command. See the --debugger=
147 option.
148
150 Example 1. List all the core dumps of a program named foo
151
152 # coredumpctl list foo
153
154 Example 2. Invoke gdb on the last core dump
155
156 # coredumpctl debug
157
158 Example 3. Show information about a process that dumped core, matching
159 by its PID 6654
160
161 # coredumpctl info 6654
162
163 Example 4. Extract the last core dump of /usr/bin/bar to a file named
164 bar.coredump
165
166 # coredumpctl -o bar.coredump dump /usr/bin/bar
167
169 systemd-coredump(8), coredump.conf(5), systemd-journald.service(8),
170 gdb(1)
171
172
173
174systemd 239 COREDUMPCTL(1)