Determining Location and Cause of "core" File in AIX Version 4.x

This document describes how to determine where the "core" file resides and which program caused it. This document applies to AIX Version 4.x only.

If a core file has been created on your system, you should have an error log entry like the following:

LABEL:          CORE_DUMP 
IDENTIFIER:     DE0A8DC4 
Date/Time:       Mon Nov 18 08:15:21 
Sequence Number: 99 
Machine Id:      000003264700 
Node Id:         katmai 
Class:           S 
Type:            PERM 
Resource Name:   SYSPROC 
Description 
SOFTWARE PROGRAM ABNORMALLY TERMINATED 
Probable Causes 
SOFTWARE PROGRAM 
User Causes 
USER GENERATED SIGNAL 
        Recommended Actions 
        CORRECT THEN RETRY 

Failure Causes 
SOFTWARE PROGRAM 
        Recommended Actions 
        RERUN THE APPLICATION PROGRAM 
        IF PROBLEM PERSISTS THEN DO THE FOLLOWING 
        CONTACT APPROPRIATE SERVICE REPRESENTATIVE 
Detail Data 
SIGNAL NUMBER 
          11 
USER'S PROCESS ID: 
       24010 
FILE SYSTEM SERIAL NUMBER 
           5 
INODE NUMBER 
           2 
PROGRAM NAME 
sleep 

In the preceding error log entry, notice that the program that dropped the core file is listed under PROGRAM NAME. In this example it is the sleep command.

1. You can configure AIX to detect when core files are created and mail a message to root, alerting root that an application has failed. The instructions for setting this up are in a README file in the /usr/samples/findcore directory. These programs are delivered with the bos.sysmgt.serv_aid fileset.

2. An alternative method of finding core files follows:
   1. Log in as root.

          find / -name core -ls 
      

   2. cd to the directory indicated in step 1.

   3. Determine which application dropped the core file by running the following command:

          lquerypv -h core 6b0 64 
      

      The program that caused the core dump is listed on the 6E0 line. For example:

      000006B0  7FFFFFFF  FFFFFFFF  7FFFFFFF  FFFFFFFF  |.............| 
      000006C0  7FFFFFFF  FFFFFFFF  7FFFFFFF  FFFFFFFF  |.............| 
      000006D0  00120000  13106060  00000000  00000003  |......''.....| 
      000006E0  736C6565  70000000  00000000  00000000  |sleep........| 
      000006F0  00000000  00000000  00000000  00000000  |.............| 
      00000700  00000000  00000000  00000000  00000018  |.............| 
      00000710  00000000  00000001  00000000  00000012  |.............| 
      

      The program that caused the core dump will be listed at the right-hand side of the line, between vertical bars (pipe symbols). In the preceding example the core file shows the sleep program. Depending on the version of AIX, the program name may be on any of the 7 lines displayed.

      If you recognize the program's name as one of your applications, you need to give the core file to your application supplier for further problem determination.

      If the program listed is an AIX command, or if you are unsure of its origin, you may want to work with AIX support on this problem.

      You should run dbx on the binary executable that caused the core dump. This will display the offending system call. In the following example the program that caused the core dump is sleep. Running dbx against the sleep command shows that the offending system call was sleep. AIX Support personnel may ask for this information in some cases.

          dbx /usr/bin/sleep core 
          Type 'help' for help. 
          reading symbolic information ...warning: no source 
          compiled with -g 
          [using memory image in core] 
          Segmentation fault in sleep at 0xd0019cd8 
          0xd0019cd8 (sleep+0x40) 80410014           1   r2,0x14(rl) 
          (dbx) where 
          sleep(??) at 0xd0019cd8 
          main(??, ??) at 0x10000378 
          (dbx) quit 
      

      If AIX Support personnel determines that the core dump needs to be sent in to the support center, then also send the output of the snap -g command. This gathers the output of the lslpp -hBc command, which is required to recreate exact operating system environments.

      A core file is generated when a program tries to do something illegal on the system. The usual cause is an attempt to access memory outside the memory assigned to the program by the system. Core files are usually caused by a program error or some type of data corruption.

      Unless the program that caused the core file is a special debug version of the program, usually the only useful information in the core file is the name of the module or program that caused the core dump.

      Examining the errpt -a log frequently alerts you to possible problems with the system that may be the cause of the core file.