1COREDUMPCTL(1)                    coredumpctl                   COREDUMPCTL(1)
2
3
4

NAME

6       coredumpctl - Retrieve and process saved core dumps and metadata
7

SYNOPSIS

9       coredumpctl [OPTIONS...] {COMMAND} [PID|COMM|EXE|MATCH...]
10

DESCRIPTION

12       coredumpctl is a tool that can be used to retrieve and process core
13       dumps and metadata which were saved by systemd-coredump(8).
14

COMMANDS

16       The following commands are understood:
17
18       list
19           List core dumps captured in the journal matching specified
20           characteristics. If no command is specified, this is the implied
21           default.
22
23           The output is designed to be human readable and contains a table
24           with the following columns:
25
26           TIME
27               The timestamp of the crash, as reported by the kernel.
28
29           PID
30               The identifier of the process that crashed.
31
32           UID, GID
33               The user and group identifiers of the process that crashed.
34
35           SIGNAL
36               The signal that caused the process to crash, when applicable.
37
38           COREFILE
39               Information whether the coredump was stored, and whether it is
40               still accessible: "none" means the core was not stored, "-"
41               means that it was not available (for example because the
42               process was not terminated by a signal), "present" means that
43               the core file is accessible by the current user, "journal"
44               means that the core was stored in the "journal", "truncated" is
45               the same as one of the previous two, but the core was too large
46               and was not stored in its entirety, "error" means that the core
47               file cannot be accessed, most likely because of insufficient
48               permissions, and "missing" means that the core was stored in a
49               file, but this file has since been removed.
50
51           EXE
52               The full path to the executable. For backtraces of scripts this
53               is the name of the interpreter.
54
55           It's worth noting that different restrictions apply to data saved
56           in the journal and core dump files saved in
57           /var/lib/systemd/coredump, see overview in systemd-coredump(8).
58           Thus it may very well happen that a particular core dump is still
59           listed in the journal while its corresponding core dump file has
60           already been removed.
61
62       info
63           Show detailed information about the last core dump or core dumps
64           matching specified characteristics captured in the journal.
65
66       dump
67           Extract the last core dump matching specified characteristics. The
68           core dump will be written on standard output, unless an output file
69           is specified with --output=.
70
71       debug
72           Invoke a debugger on the last core dump matching specified
73           characteristics. By default, gdb(1) will be used. This may be
74           changed using the --debugger= option or the $SYSTEMD_DEBUGGER
75           environment variable. Use the --debugger-arguments= option to pass
76           extra command line arguments to the debugger.
77

OPTIONS

79       The following options are understood:
80
81       -h, --help
82           Print a short help text and exit.
83
84       --version
85           Print a short version string and exit.
86
87       --no-pager
88           Do not pipe output into a pager.
89
90       --no-legend
91           Do not print the legend, i.e. column headers and the footer with
92           hints.
93
94       --json=MODE
95           Shows output formatted as JSON. Expects one of "short" (for the
96           shortest possible output without any redundant whitespace or line
97           breaks), "pretty" (for a pretty version of the same, with
98           indentation and line breaks) or "off" (to turn off JSON output, the
99           default).
100
101       -1
102           Show information of the most recent core dump only, instead of
103           listing all known core dumps. Equivalent to --reverse -n 1.
104
105       -n INT
106           Show at most the specified number of entries. The specified
107           parameter must be an integer greater or equal to 1.
108
109       -S, --since
110           Only print entries which are since the specified date.
111
112       -U, --until
113           Only print entries which are until the specified date.
114
115       -r, --reverse
116           Reverse output so that the newest entries are displayed first.
117
118       -F FIELD, --field=FIELD
119           Print all possible data values the specified field takes in
120           matching core dump entries of the journal.
121
122       -o FILE, --output=FILE
123           Write the core to FILE.
124
125       --debugger=DEBUGGER
126           Use the given debugger for the debug command. If not given and
127           $SYSTEMD_DEBUGGER is unset, then gdb(1) will be used.
128
129       -A ARGS, --debugger-arguments=ARGS
130           Pass the given ARGS as extra command line arguments to the
131           debugger. Quote as appropriate when ARGS contain whitespace. (See
132           Examples.)
133
134       --file=GLOB
135           Takes a file glob as an argument. If specified, coredumpctl will
136           operate on the specified journal files matching GLOB instead of the
137           default runtime and system journal paths. May be specified multiple
138           times, in which case files will be suitably interleaved.
139
140       -D DIR, --directory=DIR
141           Use the journal files in the specified DIR.
142
143       -q, --quiet
144           Suppresses informational messages about lack of access to journal
145           files and possible in-flight coredumps.
146
147       --all
148           Look at all available journal files in /var/log/journal/ (excluding
149           journal namespaces) instead of only local ones.
150

MATCHING

152       A match can be:
153
154       PID
155           Process ID of the process that dumped core. An integer.
156
157       COMM
158           Name of the executable (matches COREDUMP_COMM=). Must not contain
159           slashes.
160
161       EXE
162           Path to the executable (matches COREDUMP_EXE=). Must contain at
163           least one slash.
164
165       MATCH
166           General journalctl match filter, must contain an equals sign ("=").
167           See journalctl(1).
168

EXIT STATUS

170       On success, 0 is returned; otherwise, a non-zero failure code is
171       returned. Not finding any matching core dumps is treated as failure.
172

ENVIRONMENT

174       $SYSTEMD_DEBUGGER
175           Use the given debugger for the debug command. See the --debugger=
176           option.
177

EXAMPLES

179       Example 1. List all the core dumps of a program
180
181           $ coredumpctl list /usr/lib64/firefox/firefox
182           TIME     PID  UID  GID SIG     COREFILE EXE                         SIZE
183           Tue ...   8018 1000 1000 SIGSEGV missing  /usr/lib64/firefox/firefox   n/a
184           Wed ... 251609 1000 1000 SIGTRAP missing  /usr/lib64/firefox/firefox   n/a
185           Fri ... 552351 1000 1000 SIGSEGV present  /usr/lib64/firefox/firefox 28.7M
186
187       The journal has three entries pertaining to /usr/lib64/firefox/firefox,
188       and only the last entry still has an available core file (in external
189       storage on disk).
190
191       Note that coredumpctl needs access to the journal files to retrieve the
192       relevant entries from the journal. Thus, an unprivileged user will
193       normally only see information about crashing programs of this user.
194
195       Example 2. Invoke gdb on the last core dump
196
197           $ coredumpctl debug
198
199       Example 3. Use gdb to display full register info from the last core
200       dump
201
202           $ coredumpctl debug --debugger-arguments="-batch -ex 'info all-registers'"
203
204       Example 4. Show information about a core dump matched by PID
205
206           $ coredumpctl info 6654
207                      PID: 6654 (bash)
208                      UID: 1000 (user)
209                      GID: 1000 (user)
210                   Signal: 11 (SEGV)
211                Timestamp: Mon 2021-01-01 00:00:01 CET (20s ago)
212             Command Line: bash -c $'kill -SEGV $$'
213               Executable: /usr/bin/bash
214            Control Group: /user.slice/user-1000.slice/...
215                     Unit: user@1000.service
216                User Unit: vte-spawn-....scope
217                    Slice: user-1000.slice
218                Owner UID: 1000 (user)
219                  Boot ID: ...
220               Machine ID: ...
221                 Hostname: ...
222                  Storage: /var/lib/systemd/coredump/core.bash.1000.....zst (present)
223                Disk Size: 51.7K
224                  Message: Process 130414 (bash) of user 1000 dumped core.
225
226                           Stack trace of thread 130414:
227                           #0  0x00007f398142358b kill (libc.so.6 + 0x3d58b)
228                           #1  0x0000558c2c7fda09 kill_builtin (bash + 0xb1a09)
229                           #2  0x0000558c2c79dc59 execute_builtin.lto_priv.0 (bash + 0x51c59)
230                           #3  0x0000558c2c79709c execute_simple_command (bash + 0x4b09c)
231                           #4  0x0000558c2c798408 execute_command_internal (bash + 0x4c408)
232                           #5  0x0000558c2c7f6bdc parse_and_execute (bash + 0xaabdc)
233                           #6  0x0000558c2c85415c run_one_command.isra.0 (bash + 0x10815c)
234                           #7  0x0000558c2c77d040 main (bash + 0x31040)
235                           #8  0x00007f398140db75 __libc_start_main (libc.so.6 + 0x27b75)
236                           #9  0x0000558c2c77dd1e _start (bash + 0x31d1e)
237
238       Example 5. Extract the last core dump of /usr/bin/bar to a file named
239       bar.coredump
240
241           $ coredumpctl -o bar.coredump dump /usr/bin/bar
242

SEE ALSO

244       systemd-coredump(8), coredump.conf(5), systemd-journald.service(8),
245       gdb(1)
246
247
248
249systemd 250                                                     COREDUMPCTL(1)
Impressum