1COREDUMPCTL(1)                    coredumpctl                   COREDUMPCTL(1)
2
3
4

NAME

6       coredumpctl - Retrieve and process saved core dumps and metadata
7

SYNOPSIS

9       coredumpctl [OPTIONS...] {COMMAND} [PID|COMM|EXE|MATCH...]
10

DESCRIPTION

12       coredumpctl is a tool that can be used to retrieve and process core
13       dumps and metadata which were saved by systemd-coredump(8).
14

COMMANDS

16       The following commands are understood:
17
18       list
19           List core dumps captured in the journal matching specified
20           characteristics. If no command is specified, this is the implied
21           default.
22
23           The output is designed to be human readable and contains a table
24           with the following columns:
25
26           TIME
27               The timestamp of the crash, as reported by the kernel.
28
29           PID
30               The identifier of the process that crashed.
31
32           UID, GID
33               The user and group identifiers of the process that crashed.
34
35           SIGNAL
36               The signal that caused the process to crash, when applicable.
37
38           COREFILE
39               Information whether the coredump was stored, and whether it is
40               still accessible: "none" means the core was not stored, "-"
41               means that it was not available (for example because the
42               process was not terminated by a signal), "present" means that
43               the core file is accessible by the current user, "journal"
44               means that the core was stored in the "journal", "truncated" is
45               the same as one of the previous two, but the core was too large
46               and was not stored in its entirety, "error" means that the core
47               file cannot be accessed, most likely because of insufficient
48               permissions, and "missing" means that the core was stored in a
49               file, but this file has since been removed.
50
51           EXE
52               The full path to the executable. For backtraces of scripts this
53               is the name of the interpreter.
54
55           It's worth noting that different restrictions apply to data saved
56           in the journal and core dump files saved in
57           /var/lib/systemd/coredump, see overview in systemd-coredump(8).
58           Thus it may very well happen that a particular core dump is still
59           listed in the journal while its corresponding core dump file has
60           already been removed.
61
62       info
63           Show detailed information about the last core dump or core dumps
64           matching specified characteristics captured in the journal.
65
66       dump
67           Extract the last core dump matching specified characteristics. The
68           core dump will be written on standard output, unless an output file
69           is specified with --output=.
70
71       debug
72           Invoke a debugger on the last core dump matching specified
73           characteristics. By default, gdb(1) will be used. This may be
74           changed using the --debugger= option or the $SYSTEMD_DEBUGGER
75           environment variable. Use the --debugger-arguments= option to pass
76           extra command line arguments to the debugger.
77

OPTIONS

79       The following options are understood:
80
81       -h, --help
82           Print a short help text and exit.
83
84       --version
85           Print a short version string and exit.
86
87       --no-pager
88           Do not pipe output into a pager.
89
90       --no-legend
91           Do not print the legend, i.e. column headers and the footer with
92           hints.
93
94       --json=MODE
95           Shows output formatted as JSON. Expects one of "short" (for the
96           shortest possible output without any redundant whitespace or line
97           breaks), "pretty" (for a pretty version of the same, with
98           indentation and line breaks) or "off" (to turn off JSON output, the
99           default).
100
101       -1
102           Show information of the most recent core dump only, instead of
103           listing all known core dumps. (Equivalent to --reverse -n 1
104
105       -n INT
106           Show at most the specified number of entries. The specified
107           parameter must be an integer greater or equal to 1.
108
109       -S, --since
110           Only print entries which are since the specified date.
111
112       -U, --until
113           Only print entries which are until the specified date.
114
115       -r, --reverse
116           Reverse output so that the newest entries are displayed first.
117
118       -F FIELD, --field=FIELD
119           Print all possible data values the specified field takes in
120           matching core dump entries of the journal.
121
122       -o FILE, --output=FILE
123           Write the core to FILE.
124
125       --debugger=DEBUGGER
126           Use the given debugger for the debug command. If not given and
127           $SYSTEMD_DEBUGGER is unset, then gdb(1) will be used.
128
129       -A ARGS, --debugger-arguments=ARGS
130           Pass the given ARGS as extra command line arguments to the
131           debugger. Quote as appropriate when ARGS contain whitespace. (See
132           Examples.)
133
134       --file=GLOB
135           Takes a file glob as an argument. If specified, coredumpctl will
136           operate on the specified journal files matching GLOB instead of the
137           default runtime and system journal paths. May be specified multiple
138           times, in which case files will be suitably interleaved.
139
140       -D DIR, --directory=DIR
141           Use the journal files in the specified DIR.
142
143       -q, --quiet
144           Suppresses informational messages about lack of access to journal
145           files and possible in-flight coredumps.
146

MATCHING

148       A match can be:
149
150       PID
151           Process ID of the process that dumped core. An integer.
152
153       COMM
154           Name of the executable (matches COREDUMP_COMM=). Must not contain
155           slashes.
156
157       EXE
158           Path to the executable (matches COREDUMP_EXE=). Must contain at
159           least one slash.
160
161       MATCH
162           General journalctl match filter, must contain an equals sign ("=").
163           See journalctl(1).
164

EXIT STATUS

166       On success, 0 is returned; otherwise, a non-zero failure code is
167       returned. Not finding any matching core dumps is treated as failure.
168

ENVIRONMENT

170       $SYSTEMD_DEBUGGER
171           Use the given debugger for the debug command. See the --debugger=
172           option.
173

EXAMPLES

175       Example 1. List all the core dumps of a program
176
177           $ coredumpctl list /usr/lib64/firefox/firefox
178           TIME     PID  UID  GID SIG     COREFILE EXE                         SIZE
179           Tue ...   8018 1000 1000 SIGSEGV missing  /usr/lib64/firefox/firefox   n/a
180           Wed ... 251609 1000 1000 SIGTRAP missing  /usr/lib64/firefox/firefox   n/a
181           Fri ... 552351 1000 1000 SIGSEGV present  /usr/lib64/firefox/firefox 28.7M
182
183       The journal has three entries pertaining to /usr/lib64/firefox/firefox,
184       and only the last entry still has an available core file (in external
185       storage on disk).
186
187       Note that coredumpctl needs access to the journal files to retrieve the
188       relevant entries from the journal. Thus, an unprivileged user will
189       normally only see information about crashing programs of this user.
190
191       Example 2. Invoke gdb on the last core dump
192
193           $ coredumpctl debug
194
195       Example 3. Use gdb to display full register info from the last core
196       dump
197
198           $ coredumpctl debug --debugger-arguments="-batch -ex 'info all-registers'"
199
200       Example 4. Show information about a process that dumped core, matching
201       by its PID 6654
202
203           $ coredumpctl info 6654
204
205       Example 5. Extract the last core dump of /usr/bin/bar to a file named
206       bar.coredump
207
208           $ coredumpctl -o bar.coredump dump /usr/bin/bar
209

SEE ALSO

211       systemd-coredump(8), coredump.conf(5), systemd-journald.service(8),
212       gdb(1)
213
214
215
216systemd 248                                                     COREDUMPCTL(1)
Impressum