一. 查询core dump文件路径：
方法1：
# cat /proc/sys/kernel/core_pattern
方法2：
# /sbin/sysctl kernel.core_pattern
二. 修改core dump文件路径：
方法1：临时修改：修改/proc/sys/kernel/core_pattern文件，但/proc目录本身是动态加载的，每次系统重启都会重新加载，因此这种方法只能作为临时修改。
/proc/sys/kernel/core_pattern
例：echo ‘/var/log/%e.core.%p’ > /proc/sys/kernel/core_pattern
方法2：永久修改：使用sysctl -w name=value命令。
例：/sbin/sysctl -w kernel.core_pattern=/var/log/%e.core.%p
为了更详尽的记录core dump当时的系统状态，可通过以下参数来丰富core文件的命名：
%% 单个%字符
%p 所dump进程的进程ID
%u 所dump进程的实际用户ID
%g 所dump进程的实际组ID
%s 导致本次core dump的信号
%t core dump的时间 (由1970年1月1日计起的秒数)
%h 主机名
%e 程序文件名
建议尽量不要修改core dump路径而是follow如下方法使用coredump
https://stackoverflow.com/questions/16048101/changing-location-of-core-dump/24468816#24468816
Before following the instructions in the accepted answer, it could be good idea to check the contents of /proc/sys/kernel/core_pattern to see if the Redhat abrt system is in use.
-> cat /proc/sys/kernel/core_pattern
|/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e
If that is in use, then you already have a pretty extensive scheme for managing core files that you would want to understand before you override it.
In a nutshell, abrt:
- puts the core files here:
/var/spool/abrt/ - has a gui that is started with the command
abrt-gui - augments the corefile with additional information about the failed process.
- is configure with this file:
/etc/abrt/abrt-action-save-package-data.conf
One common stumbling block with using it is to change this line in the config file:
ProcessUnpackaged = no
Change that to yes to capture core files from your homebrew processes, otherwise it will only capture corefiles from programs installed by the package manager.
[EDIT to answer how to use coredump] To examine a core dump I do this:
cd /var/spool/abrt/XXXXXXX
gdb $(cat executable) coredump
There might be a better way to so that, but gdb has served me well so I have not looked for other ways. Just replace XXXXXXX with the folder that contains your coredump file. The gdb command is cut and paste ready.
三、生成coredump的大小限制
ulimit -c 查看core文件的生成开关
ulimit -c filesize命令，可以限制core文件的大小（filesize的单位为kbyte）
ulimit -c unlimited 设置core文件的大小不受限制
ulimit -c 0 阻止系统生成core文件
ulimit -a 检查生成core文件的选项是否打开，该命令将显示所有的用户定制，其中选项-a代表“all”。